89: Cybereason - Molerats in the Cloud · Darknet Diaries summary

Key takeaways

Cyber security requires advanced and proactive detection methods, such as behavioral analytics and operation-centric approaches, to identify threats before they cause harm.
Understanding the geopolitical context and language nuances is crucial in attributing cyber campaigns and understanding their motivations.
Sophisticated attackers use layered tactics, such as disguising malware as legitimate files and employing social media or cloud services for command and control, to evade detection.
Cyber Reason’s research and tools not only detect threats but also expose attacker infrastructure and techniques, helping to improve defenses worldwide.
Continuous innovation, curiosity, and collaboration are vital in staying ahead of malicious actors in the cyber domain.

Summary

Introduction and Sponsorship Details

The episode begins with the host explaining the irregular release schedule, clarifying that this special episode was sponsored by Cyber Reason. Cyber Reason, a cybersecurity company, sponsored this episode to discuss their work in tracking and combating cyber threats. The host provides an overview of the episode's content, including stories from Cyber Reason's CEO, Leora, and their threat research team, illustrating real-world cyber investigations and operations. The episode also features sponsorship messages from Delete Me, which helps individuals remove personal data from the internet, and Black Hills Information Security, which offers cybersecurity training and services.

Leora's Background and Path to Cybersecurity Leadership

Leora shares his personal story of growing up in Israel, aspiring to be a combat pilot, but ultimately enrolling in Israel's military unit 8200, which specializes in signals intelligence and cybersecurity. He discusses his rigorous training in the military, the skills he gained, and how that experience paved the way for his career in cybersecurity. After military service, he pursued university studies, worked at tech startups, and eventually co-founded Cyber Reason. His background emphasizes the importance of technical expertise, creativity, and understanding geopolitical contexts in cyber operations.

Cyber Reason’s Mission and Approach to Cyber Defense

Leora describes Cyber Reason’s mission to reverse the attacker’s advantage by developing advanced detection and response tools. The company's key innovation is an operation-centric detection method called the mallop approach, which anticipates hackers’ steps and detects malicious behaviors before malware or indicators are fully realized. Their platform analyzes vast amounts of real-time data across endpoints to identify suspicious activities, providing a comprehensive view of potential cyber threats and enabling rapid response. Their goal is to make enterprises safer and prepare them for future cyber challenges.

Stories from Cyber Research: The Molerats and Their Malware Arsenal

The episode shifts focus to narratives from Cyber Reason’s threat research team. They discuss their investigation into a cyber group called Molerats (also known as Gaza Cyber Gang), which has been active since 2012 targeting Middle Eastern entities, government officials, and political groups. The team uncovered and analyzed new malware strains, such as Spark, SharpStage, and Dropbook, used in espionage campaigns involving spear-phishing emails containing malicious attachments. The malware was often disguised as legitimate documents or locked behind social media-based command and control channels. These efforts demonstrate complex operational tactics and geopolitical motivations behind cyber espionage.

Deep Dive into the Geopolitical and Technical Aspects of Threat Research

The threat researchers emphasize the importance of geopolitical awareness when tracking sophisticated threat groups like Molerats. Their analysis considers targets’ political affiliations, regional conflicts, and historical activity to attribute operations. The team employs reverse engineering, multi-language intelligence gathering, and behavioral analysis to understand and attribute cyber campaigns. Some malware was tailored to Arabic speakers, and attackers used social media platforms like Facebook for command and control, showcasing their ingenuity and the layered complexity of attribution.

Cyber Reason’s Impact and Future of Cyber Defense

Leora concludes by highlighting Cyber Reason’s holistic security platform, which provides endpoint protection, big data analytics, and behavioral detection to identify both known and unknown threats. The company’s proactive research and development enable organizations to detect, understand, and thwart cyberattacks effectively. Their efforts contribute to a safer digital world by exposing adversaries’ tactics, techniques, and infrastructure, ultimately striving to shift the balance of power in cybersecurity back to defenders.

Show notes

The threat research team at Cybereason uncovered an interesting piece of malware. Studied it and tracked it. Which lead them to believe they were dealing with a threat actor known as Molerats.