Slide 1: Neutralizing Today’s Cyber Threats
Neutralizing Today’s Cyber Threats Fighting the Zombie Apocalypse Sig Murphy S e n i o r D i r e c t or o f P r o f ess i o n a l S e r vi c e s
Slide 2: Our Mission
OUR MISSION Our mission is to protect every computer, user and object under the sun.
Slide 3: Safe Harbor
The information in this presentation is confidential and proprietary to Cylance ® and may not be disclosed without the permission of Cylance. This presentation is not subject to your license agreement or any other service or subscription agreement with Cylance. Cylance has no obligation to pursue an
Slide 4: Sig Murphy
SIG MURPHY ▪ Formerly at Fidelis and the DoD Cybercrime Center (DC3; IA and CI) ▪ Husband, Father, Maker and Gamer (time allowing) ▪ Senior Director of Consulting Services for BlackBerry Cylance
Slide 5: Agenda
AGENDA ▪ Current Events ▪ The Evolution of Sodinokibi ▪ TrickBot or treat? ▪ Demo ▪ Evolving to Prevention ▪Q&A
Slide 6: Current Events
CURRENT EVENTS *25 BlackBerry. | Y\_/A\ NCE.
Slide 7: Texas local governments hit in coordinated ransomware attack
Over 20 Texas local governments hit in ‘coordinated ransomware attack’ 2 o Ransomware cripples US emergency services, local governments "2 BlackBerry.
Slide 8: Evolution of Sodinokibi
EVOLUTION OF SODINOKIBI *25 BlackBerry. | Y\_/A\ NCE.
Slide 9: What Are These Variants?
W H AT A R E T H E S E VA R I A N T S ? Malware: GandCrab Delivery: RAAS. Malvertizing, Spearphishing, Infected MSPs. Gandcrab terminates all locked processes, encrypts specific file extensions and presents a ransom note. Impact: By May 2019, Gandcrab was responsible for over half of all new ransomw
Slide 10: Trick(bot) or Treat?
TRICK(BOT) OR TREAT? "5 BlackBerry. | Y ANCE.
Slide 11: TrickBot Explained
TRICKBOT EXPLAINED Malware: Trickbot ▪ Features: ▪ Infection happens through weaponized Word and Excel documents from banks/services with embed macros. These drop downloader .bat files ▪ Malware is downloaded into the %APPDATA% \Roaming folder and executed ▪ Uses process hollowing to insert itself i
Slide 12: Taking a Step Back: Extraordinary Crimes
TA K I N G A S T E P B A C K WE LIVE IN A WORLD OF EXTRAORDINARY CRIMES “Thecrime Cyber aggregate damages cost willofcost cyber the is now$6estimated world at over trillion annually by $1T 2021,a up year of $3 from 2015 – thiscost, trillion ineconomic versesthe represents roughly greatest$300B trans
Slide 13: Taking a Step Back: WannaCry and NotPetya
TA K I N G A S T E P B A C K WE LIVE IN A WORLD OF EXTRAORDINARY CRIMES WANNACRY NotPetya The NSA-Grade Stuxnet of Poisoned Source-code, NSA- Ransomware Grade Worm meant to destroy $Billions $1B for Maersk, Merck, FedEx
Slide 14: Taking a Step Back: Cybercrime Damages
TA K I N G A S T E P B A C K WE LIVE IN A WORLD OF EXTRAORDINARY CRIMES Cyber crime damages will cost the world $6 trillion annually by 2021, up from $3 trillion in 2015 – this represents the greatest transfer of economic wealth in history […] and is more profitable than the global trade of all majo
Slide 15: Taking a Step Back: Aggregate Cost of Cyber
TA K I N G A S T E P B A C K WE LIVE IN A WORLD OF EXTRAORDINARY CRIMES “The aggregate cost of cyber is now estimated at over $1T a year of economic cost, verses roughly $300B experienced in 2017 lost to natural catastrophes" - John Drzik, President of Global Risk and Digital at Marsh
Slide 16: Five Facts for 2019
F I V E FAC T S F O R 2 0 1 9 TO P U T T H I N G S I N P E R S P E C T I V E Cyber Crime Costs – Will DOUBLE from $3T 2015 to $6T in 2021 Ransomware Costs – Up 15x since 2015, will be $11.5B by the end of the year, and increase 4x by 2020 Human Attack Surface – Will go from 3.8B people to 6B people
Slide 17: Demo
DEMO "5 BlackBerry. | Y ANCE.
Slide 18: Evolving to Prevention
EVOLVING TO PREVENTION "5 BlackBerry. | Y ANCE.
Slide 19: Come Join Us – We Have a Better Way
COME JOIN US – W E H AV E A B E T T E R WAY
Slide 20: The Cyber Kill-Chain continues to evolve
The Cyber Kill-Chain continues to evolve in unexpected ways, but the payloads and malware tied to campaigns and activity, do so much more predictably.
Slide 21: Netflix Predictive AI
NETFLIX PREDICTIVE AI ETFLIX "3 BlackBerry. | CY LANCE.
Slide 22: If Time Was a Spear
I F T I M E WAS A S P E AR … KNOWN THREATS UNKNOWN AHEAD OF THREATS ALL THREATS Legacy Antivirus Detonation PREDICTIVE AI Chambers, NG Firewalls / Air Gaps Call-back Web Proxies Detection, IDS/IPS Anomalytics, All Signature/Heuristic-Based Tech Cyber Threat Intelligence
Slide 23: Temporal Advantage
T E M P O R A L A D VA N T A G E To put it simply: threat actors have had a time advantage over us. We have been playing catch-up for decades.
Slide 24: Predictive AI’s Time Advantage
P R E D I C T I V E A I ’ S T I M E A D VA N T A G E INITIAL RESEARCH
Slide 25: What We Learned from WannaCry
W H AT W E L E A R N E D F R O M W A N N A C R Y C Y L A N C E P R E D I C T I V E A D VA N TA G E WITH AI NOVEMBER 2015 Predictive AI Providing Prevention 1.5 YEARS Cylance releases PROTECT model PROTECTED (version) 1350. Customers protected. VULNERABLE WITHOUT AI NOVEMBER 2015 3/12/2017 4/14/2017
Slide 26: Local Model Temporal Predictive Advantage: Sodinokibi
#### LOCAL MODEL TEMPORAL PREDICTIVE ADVANTAGE #### Sodinokibi hash "2 BlackBerry.
Slide 27: Local Model Temporal Predictive Advantage: TrickBot
#### LOCAL MODEL TEMPORAL PREDICTIVE ADVANTAGE #### Mode! g | Trickbot Hash 3 BlackBerry. |
Slide 28: BlackBerry Cylance
*F= BlackBerry. | YY \_/\ NCE.