MORE THAN MEETS THE EYE — Microsoft’s new court-driven approach to kneecapping cybercrime is as bold as it is dense — and dense it is. On Thursday, the company’s Digital Crimes Unit filed a 223-page complaint seeking to prevent criminals from abusing a powerful and easy-to-use hacking tool called Cobalt Strike. Built to help defenders identify weak points in their own networks, Cobalt Strike routinely falls into the hands of hackers, allowing them to punch (er, click) well above their weight when it comes to the speed and efficiency of mouse-pad mischief. While Microsoft has used legal tools to go after hackers before, the substance and sweep of the new action — which includes support from Fortra, the owner of Cobalt Strike, and the Health Information Sharing & Analysis Center, a health sector cyber consortium — are unique, potentially paving the way for sustained disruptions across the cybercriminal ecosystem, according to Amy Hogan-Burney, general manager of Microsoft’s DCU. “This wasn't your run-of-the-mill trademark issue,” said Hogan-Burney. New tack — Microsoft’s action represents a turn away from past takedown efforts, which focused on specific criminals and individual malware families, said Hogan-Burney. The latter showed “an ability … to reconstitute” through the use of backups and “other things,” she said, referencing the company’s short-lived attempt to short-circuit the Trickbot malware ahead of the 2020 elections. This time, said Hogan-Burney, Microsoft wanted to be “thoughtful about what works and what doesn’t.” So, the DCU tasked its threat intelligence team with finding “the mechanism that's being used in the most disruptive attacks” — an analysis that led back to filched (or “cracked”) copies of Cobalt Strike. Novel theories — To pursue a case against a mere criminal tool, however, Hogan-Burney said Microsoft needed to develop a novel and robust argument to win over the courts. Eventually, she and her team decided on a racketeering charge that would lean in two directions at once: on the destructiveness of Cobalt Strike’s most notorious abusers and the suffering of its most sympathetic victims. Hence, Microsoft’s court filing cites a who’s who of cybercrime kingpins, such as members of the EvilCorp, Conti and LockBit crime syndicates. In addition, it includes backing from the HS-ISAC, a health care-sector cybersecurity consortium which could provide testimony about how the tool had been used in debilitating ransomware attacks against hospitals across the country. HS-ISAC helped Microsoft “ground [the case] in those that are really suffering,” said Hogan-Burney. Long-term impact — Microsoft has already won a temporary restraining order, meaning it is now in the process of dismantling the domains and hosting sites outlined in its gargantuan filing. But that’s just the first leg of its effort. As soon as the firm spots criminals attempting to reach back for illicit copies of Cobalt Strike, said Hogan-Burney, it will pursue a permanent injunction and then a special master, legal maneuvers that will enable it to dismantle future such abuse without having to file new court orders — a notoriously tedious process. Those measures won’t just allow Microsoft to undercut an across-the-board enabler of cybercrime. They will help it amass more evidence against the high-profile defendants cited in the case, potentially allowing the firm to unmask some of the world’s most sought-after cyber criminals. Admittedly, that isn’t Microsoft’s top priority in the case, said Hogan-Burney. But it's not an outcome she’s ready to dismiss, either. Stolen versions of Cobalt Strike “are being used by the worst cybercrime criminals out there,” she said.
| 
No comments:
Post a Comment