Use Cases

Challenges When an enterprise or organization faces a destructive cyber attack, time is of the essence in order to be able to respond and recover from it. If the attacker group can be detected at an early stage when they have infiltrated the victim organization's network, there is still a chance to effectively block the attacker group's behavior immediately, with less impact on the enterprise or organization. However, the more serious situation that enterprises currently face is that they fail to detect cyber threats in the early stages of attackers' infiltration, or even discover them only after data has been stolen or the system has been damaged. When organizations lack the deployment of endpoint protection tools, ransomware attackers are likely to spread rapidly from the initial access point, encrypting other related systems and hundreds or thousands of important files, shutting down the business. This also makes enterprises facing more and more challenges to quickly recover from ransomware attacks and avoid business interruption caused by damaged networks. How can enterprises or organizations respond to ransomware effectively? Through the following sharing of the case in which TeamT5 assists enterprises and organizations in cybersecurity incidents you may learn how to strengthen cybersecurity defense, not only prevent malicious attacks, but also minimize the losses caused by cyber threats. Detect intrusions and respond quickly TeamT5 received a notification from an information technology company in Taiwan on July 18 that important service hosts in the network environment were subject to encryption and ransomware, and ransomware information was displayed on the desktop of the VM environment. Upon receiving this notification, the TeamT5 Cybersecurity Incident Response Team (CSIRT) grasped the critical time for incident response and took the following actions as soon as possible: Interviewed clients and clarified needs and case status The incident response team directly held an emergency meeting with the client, clarified the client's needs through interviews, and the current situation of the site being hacked: the VM environment of the ESXi host in the site was encrypted, and ransomware information was displayed on the desktop in the VM environment . Provide attack-related information for clients to evaluate and make decisions The TeamT5 team has more than 20 years of experience in cyber threat research. It immediately assists clients in interpreting the received ransomware information, confirms the ransomware group and other related information, and provides clients with the suggestions in decision-making process. Provide suggestions of blocking attackers’ control and proliferation countermeasures In order to prevent other digital assets from being affected by the attack, the TeamT5 team provides countermeasures to block the attack, including network equipment disconnection and forensics, isolated endpoint scan, system backup and other emergency response measures. Before the root cause of the incident is clarified, it is recommended that relevant network equipment and systems should not connect to the Internet nor enable network communications to prevent attackers from entering the site again to cause damage. Collection of key evidence and customized response and investigation plan In addition to providing information such as field network system configuration, related equipment information and log status, TeamT5 also proposes an overall incident investigation plan. By deploying ThreatSonar, TeamT5's self-developed threat forensic and analysis platform, it can perform evidence collection and forensic analysis on key hosts, and also confirm the cybersecurity posture of other hosts in the VM environment. The scan results found that five hosts had high-risk (Level 5) threats and one host had medium-high risk (Level 4). The analysis included hacking tools, ransomware, suspicious accounts, IP sources, etc. Investigate the root cause of the incident and visualize the attack trajectory Based on the analysis of quick scan results of the field host and the network communication records, the TeamT5 team immediately carried out related investigation operations on the occurrence of the field incident, and grasped the attack time, tools and other details in detail as follows: Ransomware: Scanning analysis found that eight of the fourteen hosts were injected with ransomware. Injection location: C:\Documents and Settings\All Users"Start" menu\Programs\Startup\fast.exe Hacking Tools: Location: C:\WINDOWS\Temp\temp(mimikatz) Incident correlation: RDP login information: Source IP, Target User, Source Workstation (MONSTER), Logon Type 10 (RDP) Through threat hunting, lateral movement trajectories are visualized, allowing clients to clearly understand the root causes of incidents and carry out subsequent enhanced cybersecurity defense plans. Restore the pre-invasion environment and strengthen defenses to prevent similar attacks. After completing the incident investigation and identifying the root cause of the incident, TeamT5 works with the client to help confirm whether the following response actions to the cybersecurity incident have been implemented. Confirm endpoint cybersecurity posture First confirm that there is no running ransomware on the endpoint. You can try to start in the system safe mode. After removing the ransomware, use ThreatSonar to continuously scan other endpoints to confirm the cybersecurity status of the endpoint. Check network access policy Check the access rules for service hosts in the field to reduce the risk of attackers moving laterally. Confirm system account usage For accounts found to be exploited in the case, if they are not known accounts, they must be immediately deactivated and the account creation time must be confirmed; domain administrator and user passwords must be changed immediately, and AD reconstruction must be evaluated. Confirm the source of the attack It is found that the source of the attack in this incident is the firewall. It is recommended to confirm the status of the firewall device, update the version, and check the device access status. Learn from incidents to optimize long-term strategies for Cybersecurity defense TeamT5 provides a complete incident investigation report. In addition to detailing the root cause of the incident, hacker groups, attack methods, etc., it also provides targeted remedies and further practical suggestions for long-term cybersecurity defense: 1. Block the source of hacker control and reduce the risk of secondary hacking: Digital assets assessment: Confirm the security status of endpoints, grasp the security status of service interfaces that are exposed and may be attacked, and reduce the risk of being controlled by hackers, encrypted and extorted, causing service shutdown. Confirm the security of VPN equipment and systems: Based on the client's actual site environment, it is recommended to patch equipment vulnerabilities, prohibit multiple people from sharing accounts, and enable the two-stage verification mechanism and device verification mechanism to prevent attackers from gaining access and moving laterally to cause damage. Control network access management : When clients use Remote Desktop (RDP), if remote management is not implemented, it is recommended to strengthen the management interface and access control of important hosts to prevent attackers from accessing important hosts through internal hosts and encrypted ransomware. Improve personnel security awareness: You need to be security aware of phishing emails and website downloads to avoid account and password theft or execution of malicious programs. 2. Strengthen cybersecurity monitoring measures to detect abnormalities early: Endpoint detection and protection: It is not only necessary to rely on anti-virus software, but also to establish a terminal security defense mechanism to reduce the risk of threats such as malicious programs, encryption ransomware, and lateral movement. Enable event log: Enable event logs such as Event ID 4688 (program execution), Event ID 4625, 4624 (login audit), etc. AD and account authorization management: Confirm the usage of privileged accounts and general accounts to avoid password theft. Network communication policy settings: Confirm the systems or terminals allowed by the rules and their open connection settings to reduce the risk of access control threats. Check the server service log: Confirm whether there is any detection or attack situation, detect it in advance, handle it as soon as possible, and prevent intrusion detection. 3. Improve data backup and system restoration mechanisms to minimize hacker losses: Strengthen the 3-2-1 backup principle to ensure that normal operations can be restored when data is damaged or encrypted, and can prevent threats such as encryption blackmail and service shutdown. By reviewing the entire cybersecurity incident handling process and reviewing whether there are any areas that need to be strengthened, firstly, this can reduce the possibility of similar attacks happening again, and secondly, even if similar cybersecurity incidents are faced again in the future, they can be handled more effectively.

Challenges As hacker attack technology continues to evolve, advanced persistent threat (APT) techniques are becoming even more complex. More and more malicious programs are able to bypass EDR (Endpoint Detection and Response) and use legitimate tools to control endpoints. According to TeamT5's latest "APT Threat Landscape in APAC 2023" report , it is now common for hacker groups to use public or open source tools or exploit vulnerabilities of web servers to execute attacks. The report also pointed out that in the entire Asia-Pacific region, Taiwan, South Korea and Japan are the countries most targeted by APT actors. In Taiwan, the government, IT industry, education and critical infrastructure sectors are the main targets of attacks. The reason why APT actors are so interested in the IT sector is that these IT companies possess good channels or privileges to access big companies or government entities through supply chain attacks. To deal with endless APT attacks, how should enterprises or organizations effectively deal with them? The following case reveals how TeamT5 actually assists enterprise organizations to handle APT attacks. In this case, you may understand hacker attack techniques and how incident response measures reduce the losses to strengthen future cybersecurity defense. Since APT attacks are hidden and targeting specific enterprises, there are usually no obvious signs. Threats must be found through threat intelligence or EDR with APT detection capabilities. In a real case, a client used ThreatSonar, a threat forensic analysis platform developed by TeamT5, to conduct a scan of critical endpoints and analyze the scan results to understand whether there are potential threats. After inspection, it was gradually discovered that the hosts were installed with APT backdoors and Webshells. After receiving the detection report, TeamT5 immediately made further plans for the client, expanded scanning scope and analysis of endpoints in the field, and initiated the cybersecurity incident investigation service stage. TeamT5’s Cyber Security Incident Response Team (CSIRT) assists clients in accessing the situation and the attacker's possible intrusion methods, and provides clients with immediate suggestions to block the attacker's control and proliferation to avoid affecting other digital assets. In order to clarify the scope of attacks in the environment, TeamT5 helps clients take the following key actions: Key forensic analysis : Based on the circumstances of the case, the TeamT5 team identified the major compromised host. Per its operating system, forensic analysis by professional tools, and analysis of the network equipment communication log at the time of the incident, TeamT5 conducted incident-related investigations. Deploy endpoint scanning to identify the scope of attacks : By deploying ThreatSonar to perform endpoint scanning, it was found that the memory of a host hit the APT rule, triggering a high-risk (Level 5) threat alert. After analysis by TeamT5, it was confirmed that a backdoor program, a malicious threat, was placed into the memory along with threat information such as suspicious file paths and malicious C2 server lists. It is recommended that clients block malicious C2 servers and check whether the firewall has records of endpoints trying to connect to the servers. Based on the incident investigation report generated by ThreatSonar and network record analysis, the TeamT5 team performed correlation investigations of on-site incidents to understand the attackers’ path and root cause of the incident: Analysis of critical endpoints’ scan results : A malicious threat is found in the connection record of an executable file on the field host, and the malicious C2 domain of the threat information was hit. Incident investigation to find out the root cause : After identifying the risk host, investigation and analysis were initiated to find out the hacker control chain. From the correlation between the Web Log and the Event Log of the system with abnormal conditions, it was discovered that as early as half a year ago, the system had been implanted with a Webshell by attackers. After the attackers took advantage of the system vulnerability of the third-party service to gain control, they then used Softether and a set of Trojans to establish footholds. Further tracing back on the attack incident, we learned that the attacker abused PowerShell commands for execution by SQL permissions, and summarized the accounts that may have been controlled, as well as the IP information of attack source. Comprehensive assessment of the endpoints’ security status : In order to ensure the security status of endpoints in the site, the scanning scope was expanded. From the memory analysis, it was found that other on-site hosts were injected with the GhOst backdoor program. Introducing professional cybersecurity monitoring services to strengthen cybersecurity protection : TeamT5 Managed Detection and Response Services (MDR) provide clients with one-stop services such as threat monitoring, analysis, response, and investigation, reducing the burden of enterprise cybersecurity operations while achieving comprehensive risk control. To prevent similar incidents from happening again, TeamT5 provides clients with the following cyber defense suggestions: Block the sources of hacker control take complete review of the security status of digital assets, confirm VPN equipment and system vulnerability patching, strengthen access control of critical hosts, and improve personnel's security awareness of phishing emails or website downloaders. Strengthen monitoring and analysis measures establish an endpoint security monitoring mechanism to provide real-time alerts and block malicious behaviors; confirm the settings of network communication rules or the settings of terminal connections. Establish an incident response mechanism Develop incident response procedures for the high-risk incidents that may occur, including pre-compromise monitoring and analysis, mitigation during the incident, and subsequent recovery and improvement, etc., so that they can be followed when an incident occurs.

Challenges As we all know, hackers often use various network attack methods, such as zero-day attacks, phishing, brute force attacks, social engineering, malware, etc., in an attempt to gain system access and sensitive data. Then, the data is used to target enterprises, governments, or individuals. All these cyber threat events pose a major threat. Taking the leakage of personal information as an example, it causes people to lose money due to fraud and directly damages the reputation of enterprises. According to an IBM report[1], the global average cost of data breach reached USD $4.45 million in 2023, including operating losses, business shutdowns, remediation, legal fees and other expenses. These losses alone may be enough to bankrupt a small company. In addition, Harvard Business Review[2] pointed out that data leakage may lead to reduction in credit rating, the loss of competitive advantage, and expose the company to higher borrowing costs and financial risks. Therefore, how should companies or organizations effectively deal with cybersecurity incidents caused by malicious attacks? The following is a case in which TeamT5 actually assists companies and organizations in handling personal data breach. In this case, you may learn (1) how hackers obtain sensitive personal data through network attacks; (2) the emergency response measures required to deal with the incident; (3) how to reduce the losses caused by the incident threat to the minimum, and plan the defense priorities for future. If a personal information breach is discovered, we will quickly assist in handling it. When TeamT5 received the client's demand for cybersecurity incident handling - the company's information had been leaked, causing people to be defrauded, and important service hosts in the network environment had anti-virus alerts. After receiving the client's request, TeamT5 Cybersecurity Incident Response Team (CSIRT) interviewed the client to understand the case situation, grasped the WebShell and malicious program alarm information of the website host , and provided relevant incident analysis and handling suggestions: Interpret alarm information and determine possible causes The TeamT5 team has more than 20 years of experience in cyber threat research, and promptly assists clients in interpreting received alarms and determining possible intrusion routes for attackers. Provide response suggestions to control the spread of incidents In order to prevent other digital assets from being affected, the TeamT5 team recommends taking emergency response measures such as disconnecting network equipment for forensics, endpoint isolation scanning, and system backup analysis. Before the root cause of the incident is clarified, the device will not be able to access the Internet and network communications to prevent attackers from entering the site again to cause damage. If a system cannot be isolated offline due to business operation requirements, it is recommended to adopt the minimum access principle to limit the system to only connect to relevant hosts and control the scope of service access. Collection of key evidence, investigation analysis and planning In addition to the field network system configuration, related device information and log status provided by the client, TeamT5 also proposes a complete incident investigation plan by deploying TeamT5's self-developed threat forensic and analysis platform on the field host endpoint. ThreatSonar, coupled with professional forensic tool analysis, allows professional security incident investigators to confirm the security status of service hosts and other operating computers in the environment. Endpoint detection and analysis to understand the scope of attacks On the day of the incident, TeamT5 immediately assisted the client in taking the following key actions: Key forensic analysis: Based on the circumstances of the case, the TeamT5 team identified the host that may be the key incident, and used professional tools to conduct forensic analysis and network equipment communication records at the time of the incident for further investigation into incident correlation. Comprehensive scan of endpoints and list of compromised areas: ThreatSonar quickly scanned the security of hosts in the site and found that the host involved had high-risk (Level 5) threats. It analyzed the malicious threats that hit the APT detection rules, abnormal login events, suspicious file paths, and malicious relay station (C2) list and other threat information. ; Another host was detected to have malicious behaviors such as lateral movement and attackers using remote desktop services. Investigate the root cause of the incident and visualize the attack trajectory Based on the analysis of quick scan results of the field host and the network record analysis, the TeamT5 team performed related investigation operations on the occurrence of the field event, enabling them to understand the attack path and the root cause of the hack: Incident investigation and analysis: It was found that weak passwords (weak passwords) that are easily cracked were exploited on the website management page. Webshell was detected on the website. After inspection, it was found that the hacker uploaded the malicious web program to the target server through a vulnerability of file upload. At the same time, it was discovered that there was a leakage of relevant file information on the official website. Field evidence correlation: From the host event log, it was discovered that there were subsequent behaviors such as Powershell and lateral movement, and the accounts that may have been controlled and used were summarized, as well as the attack source IP information. Comprehensive investigation results: Through the visual summary of event trajectories, clients can understand the attack path of the incident and clearly understand how the attacker exploited the website's weaknesses and accessed the website's backend through different IPs, and then obtained a privileged account to have lateral movement. Block the source of the attack and restore the incident environment After completing the incident investigation and identifying the root cause of the hack, TeamT5 works with the client to help determine the relevant response actions required for the security incident: Confirm whether the security status of field endpoints is clean Through the endpoint security scanner, first confirm whether the endpoints in the field have malicious threatening behaviors, such as backdoors, hacking tools, lateral movement, etc., and then scan and confirm with anti-virus software, and then allow the endpoints to access the Internet one by one. Review whether network access rules are strict Check the rules for network management and general users in the domain to access the service host to prevent all hosts from being able to remotely log in to the service host, such as RDP, WinRM, SMB, Anydesk, etc., and block the risk of lateral movement of attackers. Confirm whether the system account permissions are appropriate For the exploited account, if it is not a known account, it must be deactivated immediately and the account creation time must be confirmed; in addition, if AD has been implanted with a backdoor or lateral movement, the domain administrator and user passwords must be changed immediately, Evaluate whether to rebuild AD. Confirm whether system vulnerabilities can be controlled Analyze and investigate system records such as websites, APs, and DBs to confirm whether there are malicious sources and behaviors, block the discovered malicious sources, and repair possible vulnerabilities. Analyze and investigate the connection source of the firewall and account usage, confirm the device status and update the version. You must ensure that the device is safe before going online for service. Review cybersecurity strategies and strengthen future defenses In order to prevent similar incidents from happening again, TeamT5 recommends that clients follow the US NIST Cybersecurity Framework and review the identification, protection, detection, response, recovery, etc. in the enterprise field. Five major aspects of defense: 1. Strengthen field system security (identification, detection, protection) Understand the configuration and operation of system endpoints in the field. Strengthen backend management accounts and restrict access sources. Control data access sources and restrict the use of dangerous pre-stored programs. Systems with files upload function need to have a malicious file detection and prevention mechanism. 2. Strengthen monitoring and analysis measures (identification, detection, protection) Import endpoint scanning and monitoring mechanism to provide real-time alerts and block malicious behaviors. Strengthen network behavior monitoring and system service record backup and analysis mechanisms. Establish a threat information output mechanism to detect suspicious threat sources and field weaknesses early. 3. Establish incident response mechanism (response & recovery) For the types of high-risk incidents that may occur (such as ransomware, personal data theft, APT intrusion, etc.), follow the NIST Incident Response Plan to establish an IR Playbook and formulate incident handling procedures (including pre-incident monitoring and analysis, mitigation and elimination during the incident, and post-incident recovery improvement, etc.) so that you can follow the instructions when an incident occurs. Reference [1] IBM: Cost of a Data Breach Report 2023 [2] Keman Huang, Xiaoqing Wang, William Wei, and Stuart Madnick, 2023, “The Devastating Business Impacts of a Cyber Breach,” Harvard Business Review [3] NIST Cybersecurity Framework [4] NIST Computer Security Incident Handling Guide

Challenges facing the financial industry Overall threat If a major cybersecurity incident occurs, such as a breach of the transaction system or the theft of end-customer data, it could damage the brand's reputation. Maintenance challenges The maintenance principle in the financial industry is mostly product implementation. Equipment (such as ATMs) and important transaction systems need to be in isolated networks, and solutions that meet this requirement need to be deployed. Financial institutions store a lot of personal and sensitive data within their environments, which should not be transferred to external environments, so they need to seek localized solutions. Compliance with regulations In accordance with the laws and regulations of various countries, utilize threat intelligence to deploy relevant countermeasures. How we can help ThreatSonar can import information from previous incidents to conduct a comprehensive check for any remaining malware. ThreatSonar has a dual mode: it can continuously monitor endpoint status within an environment; or it can perform a single malware detection job. ThreatSonar provides diverse intelligence to anticipate potential attacks and prevent them from occurring. The solution has effectively detected APT events on multiple occasions, helping customers avoid losses and maintain normal operations.

Challenges facing the medical institutions Maintenance challenges The operation of medical institutions prioritizes people's lives and safety, with system stability as the primary consideration, and also requires the implementation of stable cybersecurity solutions. Personal data security Medical institutions store a large amount of medical records, which are sensitive personal data and should not be uploaded to the cloud, as this increases the risk of leakage. How we can help The solution has been effective in detecting APT events on multiple occasions, helping customers avoid losses and maintain normal operations. With continuous threat monitoring, malicious threats can be identified in real time, so users no longer need to worry about unprepared emergencies. The ThreatSonar system's offline version ensures that data is not transferred across borders, and the data itself is encrypted and protected, effectively safeguarding patient data.

Challenges facing the high tech industry Ransomware attacks These attacks target not only a single computer but can also affect multiple computers, disrupting the entire system and causing operational shutdowns. Important business data is also stolen during these attacks, allowing attackers to demand ransom. Furthermore, such data breaches can lead to demands for compensation from partner companies and fines from government regulatory agencies based on applicable laws. Maintenance challenges The enterprise simultaneously hosts both IT and OT environments, resulting in high system complexity. How we can help The solution features a ransomware defense module, providing preventative measures such as pre-emptive alerts and real-time blocking. Persistent threat monitoring instantly identifies malicious threats, eliminating user concerns about unprepared emergencies. The solution has effectively detected APT events on multiple occasions, helping customers avoid losses and maintain normal operations.