Threat Actors Exploiting Legitimate Software For Stealthy Cyber Attacks

CAMO, or Commercial Applications, Malicious Operations, highlights attackers’ increasing reliance on legitimate IT tools to bypass security defenses, which can be used for various malicious activities like ransomware distribution, network scanning, lateral movement, and C2 establishment.

It can mislead security personnel during investigations, leading to successful compromises. Organizations should use GreyMatter Hunt packages to establish a baseline of existing IT tools, detect malicious activity, and implement appropriate mitigation measures to prevent such attacks.

The Relia Quest report highlights a significant increase in the misuse of commercial applications for malicious operations (CAMO) by threat actors.

These applications, once legitimate tools for IT management and deployment, are now being exploited to advance attacks and evade detection.

It emphasizes the need for organizations to recognize and mitigate the risks associated with CAMO by implementing robust security measures, including policies, controls, and threat detection capabilities.

Decoding Compliance: What CISOs Need to Know – Join Free Webinar

By understanding the techniques used by attackers and proactively addressing these threats, organizations can better protect their valuable assets and reduce the likelihood of successful cyberattacks.

CAMO, a stealthy attack technique, leverages legitimate software’s intended functions for malicious purposes.

Unlike LOLBAS, which relies on native system utilities, CAMO employs open-source, freely available, or illegally modified tools, which often possess valid code-signing certificates, evading security policies.

Organizations’ incomplete tool inventories and the tools’ legitimate nature hinder detection, which allows attackers to operate undetected, complicating threat response and increasing the risk of successful attacks.

Cybercriminals frequently discuss the use of legitimate tools for malicious purposes on online forums, which found that adversaries commonly employ software deployment tools like PDQ Deploy, cloud storage tools like Rclone, network scanners like SoftPerfect, and remote management tools like AnyDesk for covert operations.

These tools offer advantages like evading detection and reducing the barrier to entry for less skilled attackers, reads the Relia Quest report.

The widespread sharing of cracked versions of these tools further facilitates their abuse, enabling attackers to launch damaging attacks without significant investment.

The threat actors in the analyzed cases employed CAMO techniques to avoid detection and hinder investigations.

By leveraging legitimate tools like PDQ Deploy and Total Software Deployment, they blended malicious actions into routine network operations.

PDQ Deploy was used to spread ransomware, while Total Software Deployment facilitated lateral movement through the installation of ScreenConnect.

These CAMO tools challenged traditional defensive measures, emphasizing the importance of implementing network segmentation and application whitelisting to mitigate such threats.

The “Inc Ransom” and “Black Basta” ransomware groups exploited legitimate IT tools, SoftPerfect and AnyDesk, to compromise systems and exfiltrate data.

SoftPerfect was used to scan networks and identify vulnerabilities, while AnyDesk provided remote access for malicious activity that was employed to evade detection and blend into legitimate operations.

According to Relia Quest, to mitigate these threats, organizations should block unauthorized cloud services, restrict RMM tools, and monitor suspicious activity.

Simulating Cyberattack Scenarios With All-in-One Cybersecurity Platform – Watch Free Webinar