NHIs Are the Future of Cybersecurity: Meet NHIDR

The digital landscape is evolving, and with it, the threat environment grows more complex. As cyberattacks surge in both frequency and sophistication, organizations face unprecedented challenges in protecting sensitive data and critical infrastructure. Among these challenges, the rise of Non-Human Identities (NHIs) has introduced a new frontier in cybersecurity.

What Are Non-Human Identities?

Non-Human Identities refer to digital entities such as APIs, IoT devices, machine learning models, and automated systems. These entities are essential for modern businesses, driving efficiency through automation, AI, and interconnected technologies. However, they also expand the attack surface, creating vulnerabilities that cybercriminals are quick to exploit.

Unlike human users, NHIs cannot rely on traditional security measures such as multi-factor authentication or behavior-based monitoring. Attackers can impersonate NHIs to infiltrate systems, move laterally across networks, and orchestrate large-scale attacks, often bypassing conventional defenses with ease.

The Rising Threat of NHIs

By 2025, NHIs are projected to become the primary attack vector in cybersecurity. As organizations embrace digital transformation, the exponential growth of NHIs creates an attractive target for hackers. From API exploitation to AI model manipulation, cybercriminals are leveraging NHIs to launch sophisticated supply chain attacks and compromise critical systems.

The challenge lies in detection and response. When an NHI is compromised, attackers can exploit it within minutes. Yet, most organizations take months to identify and mitigate breaches, leaving them vulnerable to catastrophic data losses and reputational damage.

Introducing NHIDR: A Game-Changer in Cybersecurity

To address this growing threat, Entro has introduced Non-Human Identity Detection and Response (NHIDR)—a cutting-edge solution designed to protect NHIs proactively. NHIDR empowers organizations by:

• Establishing Behavioral Baselines: By analyzing historical data, NHIDR builds unique behavioral models for each NHI, eliminating the need for prolonged observation periods.
• Real-Time Monitoring: Continuous surveillance of NHIs ensures that any deviation from established baselines is detected instantly.
• Automated Remediation: NHIDR doesn’t just detect anomalies—it acts on them. When a threat is identified, it can revoke access tokens, rotate credentials, or isolate compromised identities in real time.

The Power of Real-Time Detection and Automated Response

Consider this scenario: A cybercriminal attempts to access sensitive data by exploiting an NHI. NHIDR detects the suspicious activity immediately, flags it, and initiates an automated response. Access is revoked, and credentials are updated—all before the attacker can proceed further.

This real-time capability is crucial for combating day 0 threats, which emerge faster than traditional security teams can respond. By automating responses, NHIDR not only thwarts attacks but also reduces the manual workload on security teams, allowing them to focus on strategic initiatives.

Proactive Security for the Future

NHIDR represents a paradigm shift from reactive to proactive cybersecurity. By continuously monitoring and analyzing NHIs, it empowers organizations to prevent breaches before they occur. Its automated remediation processes minimize downtime, enhance security posture, and protect the digital identities that drive modern business operations.

The Bottom Line

As the reliance on NHIs grows, so does the need for advanced solutions like NHIDR. With its innovative approach to non-human identity security, NHIDR ensures that organizations can stay one step ahead of cybercriminals, safeguarding their systems in an era of unprecedented digital transformation.

Embrace the future of cybersecurity. Embrace NHIDR.

DirtyMoe Malware Infects 2,000+ Ukrainian Computers for DDoS and Cryptojacking

The Computer Emergency Response Team of Ukraine (CERT-UA) has warned that more than 2,000 computers in the country have been infected by a strain of malware called DirtyMoe.

The agency attributed the campaign to a threat actor it calls UAC-0027.

DirtyMoe, active since at least 2016, is capable of carrying out cryptojacking and distributed denial-of-service (DDoS) attacks. In March 2022, cybersecurity firm Avast revealed the malware’s ability to propagate in a worm-like fashion by taking advantage of known security flaws.

The DDoS botnet is known to be delivered by means of another malware referred to as Purple Fox or via bogus MSI installer packages for popular software such as Telegram. Purple Fox is also equipped with a rootkit that allows the threat actors to hide the malware on the machine and make it difficult to detect and remove.

The exact initial access vector used in the campaign targeting Ukraine is currently unknown. CERT-UA is recommending that organizations keep their systems up-to-date, enforce network segmentation, and monitor network traffic for any anomalous activity.

The disclosure comes as Securonix detailed an ongoing phishing campaign known as STEADY#URSA targeting Ukrainian military personnel with the goal of delivering a bespoke PowerShell backdoor dubbed SUBTLE-PAWS.

“The exploitation chain is relatively simple: it involves the target executing a malicious shortcut (.lnk) file which loads and executes a new PowerShell backdoor payload code (found inside another file contained within the same archive),” security researchers Den Iuzvyk, Tim Peck, and Oleg Kolesnikov said.

The attack is said to be related to a threat actor known as Shuckworm, which is also known as Aqua Blizzard (formerly Actinium), Armageddon, Gamaredon, Iron Tilden, Primitive Bear, Trident Ursa, UNC530, and Winterflounder. Active since at least 2013, it’s assessed to be part of Russia’s Federal Security Service (FSB).

SUBTLE-PAWS, in addition to setting up persistence on the host, uses Telegram’s blogging platform called Telegraph to retrieve the command-and-control (C2) information, a technique previously identified as associated with the adversary since early 2023, and can propagate through removable attached drives.

RAT Malware Targeting Mexican Firms with Financial Fraud Tricks

Mexican financial institutions are under the radar of a new spear-phishing campaign that delivers a modified version of an open-source remote access trojan called AllaKore RAT.

The BlackBerry Research and Intelligence Team attributed the activity to an unknown Latin American-based financially motivated threat actor. The campaign has been active since at least 2021.

“Lures use Mexican Social Security Institute (IMSS) naming schemas and links to legitimate, benign documents during the installation process,” the Canadian company said in an analysis published earlier this week.

“The AllaKore RAT payload is heavily modified to allow the threat actors to send stolen banking credentials and unique authentication information back to a command-and-control (C2) server for the purposes of financial fraud.”

It seems that the attacks are specifically intended to target big businesses with annual sales of more than $100 million. Retail, agriculture, the public sector, manufacturing, transportation, commercial services, capital goods, and banking are among the industries targeted.

The first step in the infection chain is the distribution of a ZIP file through phishing or drive-by compromise. This file contains an MSI installer file that launches a.NET downloader, which verifies the victim’s geolocation in Mexico and retrieves the modified AllaKore RAT, a Delphi-based RAT that was first discovered in 2015.

“AllaKore RAT, although somewhat basic, has the potent capability to keylog, screen capture, upload/download files, and even take remote control of the victim’s machine,” BlackBerry stated.

The threat actor has added new features to the malware, such as support for banking fraud-related commands, targeting cryptocurrency trading platforms and banks in Mexico, initiating a reverse shell, extracting content from the clipboard, and fetching and executing additional payloads.

The campaign’s use of Mexico Starlink IPs and the addition of Spanish-language instructions to the modified RAT payload provide the threat actor with links to Latin America. Moreover, the lures used are only effective for businesses big enough to submit reports directly to the department of the Mexican Social Security Institute (IMSS).

“This threat actor has been persistently targeting Mexican entities for the purposes of financial gain,” the business stated. “This activity has continued for over two years, and shows no signs of stopping.”

The results coincide with the announcement from IOActive that it has discovered three vulnerabilities (CVE-2024-0175, CVE-2024-0176, and CVE-2024-0177) in the Lamassu Douro bitcoin ATMs that could provide physical access to an attacker the ability to take complete control of the machines and steal user data.

The ATM’s software update mechanism and its capacity to scan QR codes are exploited by the attackers to supply their own malicious file and start the execution of arbitrary code, thereby enabling the attacks. In October 2023, the Swiss company resolved the issues.