Year of the RAT: Keep your business out of the reach of RATs

2020 is the Year of the Rat, so we’re kicking the year off with everything you need to know about the nefarious RATs… Remote Access Trojans. In the first post, we described a RAT’s capabilities and the necessary steps to take in order to protect your infrastructure against this type of cyberattack. In this second installment, we’re taking a look at just how much of a threat a RAT is to your system.

Let’s be honest, IT systems are not protected by nature, and threats these days have become so elaborate that even trained employees can be tricked by a fake urgent invoice. In essence, as soon as you possess IT equipment, you are at risk of a breach.

Fortunately, this is not the end of the story. It is still possible to maintain your team’s productivity (and connectivity) while properly addressing the security of your environment. In the face of many and varied cyber risks, there are a number of robust technologies available to protect against those risks and ensure business continuity.

That said, it would be foolish to believe that no RAT will ever breach your system. It is, therefore, necessary to understand the causes and consequences of those attacks in order to best prepare to both prevent them and mitigate their damage. What are a RAT’s local actions? What are the consequences for your business? How can you ensure continued operations in spite of a breach?

How does a RAT establish its nest in your system?

Once a RAT has sneaked inside one of your systems, its primary objectives are to remain undetected and to ensure its persistence. In order to do so, it will try to modify the systems to disable countermeasures, and then to hide. This kind of activity is only possible, however, with elevated user rights. Thus, the RAT will undertake two important actions: stealing credentials and elevating its privileges.

• Obtaining local and remote credentials is critical for malware to ensure its survival. Several techniques are available, ranging from scanning the local system to identify hardcoded credentials to brute force attacks, recording of screens and keyboard inputs, to more sophisticated techniques such as stealing NTLM hash, tickets, etc.
• With the stolen credentials the malware is able to elevate its privileges and is able to obtain sufficient authorizations to access critical programs or data… and to steal or modify them.
• With the right privileges, the RAT is also able to install and use tools to propagate in your network.

The business risks of letting a RAT loose

With its newly-acquired, elevated level of authorization, a RAT can easily derail your organization. Once it has ensured that it is firmly entrenched in your system, it will start its harmful activity.

At first, it might collect local intelligence in order to more easily spread across your infrastructure, but it doesn’t end there. A local malware will eventually end up identifying critical information and exfiltrate it so that the attacker can then sell it on the dark web or, even more easily, encrypt it and demand a ransom.

Clearly, malware can severely harm your business, disrupt your activity, damage your brand reputation, expose you to non-compliance charges, and can expose your customers, employees, and partners.

Mitigate the risk and ensure productivity

So the question remains, how can you defend against these dangerous RATS without impacting efficiency and business processes?

Powerful solutions exist to protect your local systems. They act at several critical levels to stop the RAT from infiltrating your sensitive assets:

• Privileged User Management,
• Process Management, and
• Credentials Management

Eliminating the risks associated with over-privileged users is the first step. Local administrators – end-users with administrator privileges – can easily expose the local system as well as your entire network to malware, ransomware, and other cyber threats. Eliminating local admin rights means that even if a RAT finds its way in and impersonates an end-user, its metaphorical wings are clipped. Without the ability to escalate its privileges, the RAT is unable to perform malicious activities.

However, users still need privileges to perform their tasks. Solutions implementing the Principle Of Least Privilege grant the right privilege to the right application at the right time, so that the productivity of your teams is ensured while the system remains protected.

What’s more, advanced solutions allow you to grant authorizations per application. This guarantees that critical processes can’t be diverted, and misuse of processes and programs is blocked, preventing them from potentially harming the system or exposing data to be hijacked.

Solutions providing automatic password management propose an interesting approach to risk mitigation. Credentials are stronger such that their resilience to brute force attack is reinforced while regular rotations limit the lifespan of the credentials that could potentially have been stolen by the RAT.

Implementing these types of protection does not have to be complex. A thoughtful PAM solution offers numerous systems protections to prevent a RAT from acting, relying mainly on Privilege Escalation and Delegation Management (PEDM) capabilities. Workstations can also benefit from those protections with Endpoint Protection Management (EPM). Both solutions:

• Prevent the RAT from acquiring privileges with the enforcement of the Principle Of Least Privilege (POLP) so that only the minimum rights are granted to users at any given time.
• Make it impossible to hijack powerful local accounts with the implementation of zero local administrator policies.
• Protect applications and processes from over-privileged users thanks to contextual privileges for applications and processes instead of per user.
• Prevent the re-use of stolen passwords thanks to automatic password rotation and password management to establish strong complex passwords to contain dedicated passwords attacks.

How can you take your defense against the RATs even further? In our next installment, we’ll discuss how full perimetric protection of your infrastructure can be used to block the RAT from multiplying across your environment.