New MITRE Techniques and Enhanced User Interface Will Be Demonstrated at DEF CON Red Team Village

Boston, Mass. and Tel Aviv, Israel – August 6, 2020 – Guardicore, the segmentation company disrupting the legacy firewall market, today unveiled new capabilities for Infection Monkey, its free, open source breach and attack simulation (BAS) tool that maps to the MITRE ATT&CK knowledge base and tests network adherence to the Forrester Zero Trust framework.

New capabilities include an expanded list of MITRE ATT&CK techniques, user interface improvements, and increased security measures for the user. Today’s updates demonstrate Guardicore’s commitment to empowering cybersecurity professionals with sophisticated but easy-to-use tools that significantly improve security posture. Guardicore will be showcasing the open source tool’s new functionality and user interface together with the already existing features at this year’s DEF CON Red Teams Village’s virtual conference on Thursday, August 6th at 8:30 p.m. ET.

Infection Monkey is a self-propagating testing tool that hundreds of information technology teams from across the world use to find weaknesses in their on-premises and cloud-based data centers. Over the past four years, Infection Monkey has gained significant momentum and popularity amongst the cybersecurity community. With more than 3,200 stars on Github, Infection Monkey is trusted by large enterprises, educational institutions, and more, and has garnered praise from distinguished industry analysts such as Dr. Chase Cunningham, principal analyst at Forrester.

“In cyberspace and in cyber warfare exploitation, attacks succeed because they locate and leverage the weak points in systems and networks. In order to defend from this type of attack cycle, it is necessary to continually test the system for those likely weak points. But this can be difficult, especially when dealing with large infrastructures that are bridged between cloud, non-cloud, on premises, off premises, and a wide variety of other potential configurations. Infection Monkey is one of the most well-aligned tools that fits this need. I’m a huge fan.” – from Chase Cunningham’s “Cyber Warfare – Trust, Tactics, and Strategies”

Expanded MITRE ATT&CK Techniques and Reporting
Recognizing that cybersecurity experts and enterprise DevSecOps teams continue to rely on the MITRE-developed ATT&CK framework as the foundation for network security tests and assessments, Infection Monkey 1.9.0 now offers a total of 32 MITRE ATT&CK techniques available for testing. These new attack techniques enable cybersecurity professionals to exhaustively test their network like never before while also empowering them to easily communicate steps towards actionable remediation with all relevant stakeholders, from IT to the C-suite.

Improved Usability
As the cybersecurity skills gap continues to widen and IT teams find themselves short-staffed, Infection Monkey 1.9.0 received several interface improvements that ensure the tool can be easily implemented – and most importantly valuable – with no additional staff or education.

Infection Monkey 1.9.0’s user interface has been significantly upgraded for configuration, making it easier than ever to set up a variety of different test scenarios on the network. In addition, Infection Monkey 1.9.0 now runs more stealthily to avoid interruptions in attack simulations, and improve coverage rates.

Secure By Default
Guardicore is committed to ensuring that Infection Monkey offers the highest standards of quality and safety as a tool. Deployed in enterprise production data centers and cloud deployments, delivering a secure and stable tool is a top priority.

Therefore, Infection Monkey 1.9.0 now requires a secure login by default and has also been verified as secure by Synk.io, a security firm that continuously scans for vulnerabilities in software dependencies. Users of Infection Monkey 1.9.0 can be confident that the tool is safe and secure for deployment.

“Our mission with Infection Monkey is to equip cybersecurity professionals with a valuable open source tool that helps improve their security posture against cybercriminals,” said Shay Nehmad, Team Lead and Open Source Software Developer, Guardicore. “With this new version, we have made it easier than ever to use the tool’s sophisticated features.”

About Guardicore
Guardicore is the segmentation company disrupting the legacy firewall market. Our software-only approach is decoupled from the physical network, providing a faster alternative to firewalls. Built for the agile enterprise, Guardicore offers greater security and visibility in the cloud, data-center and endpoint. For more information, please visit optimizeme.online or go to Twitter or LinkedIn.

Open Knowledge Base of Persistent Botnet Threats Helps Security Teams Turn Intelligence Into Action; Unknown Decentralized Worm Discovered Upon Launch

Boston, Mass. and Tel Aviv, Israel – June 30, 2020 – Guardicore, a leader in data center and cloud security, today announced that its global research division, Guardicore Labs, has launched the Botnet Encyclopedia. Guardicore’s Botnet Encyclopedia provides a continuously updated universal knowledge base of past and present botnet campaigns researched by the Labs team – many of which previously unknown to the cybersecurity community – showcasing the greatest threats to enterprise security in a single, open location.

The Botnet Encyclopedia is powered by the Guardicore Global Sensors Network (GGSN), a network of detection sensors deployed in data centers and cloud environments around the world, capable of capturing and recording complete attack flows to the highest resolution. The Botnet Encyclopedia is designed to allow security teams, IT teams, researchers and the cybersecurity community at large to better understand and protect themselves from persistent and advanced threats, identified as campaigns.

FritzFrog, a mass-scale attack campaign active since January 2020 in which a sophisticated Golang binary is deployed on brute-forced SSH servers, is one of the first Botnet Encyclopedia campaign entries. Research identifies FritzFrog as a highly concerning peer-to-peer botnet with no centralized infrastructure, rather one whose control is distributed among its nodes. Its discovery as a decentralized worm makes it particularly unusual and dangerous. In addition, the research team identified racist terminology hard coded in the malware.

“FritzFrog is the type of threat that must be recognized as a campaign due to its operational longevity and danger it presents, particularly as a previously unknown threat,” said Ophir Harpaz, security researcher, Guardicore. “It’s our mission to bring these campaigns to light on a rolling basis and provide a level of context unavailable in any other public knowledge base in order to equip the cybersecurity community with the required information to defend itself and mitigate risk. Our research and analysis of FritzFrog is ongoing. We’ve been unearthing new findings into its enterprise impact and attacker attribution on a daily basis. We encourage all contributions, questions and suggestions from the community to enhance our findings into FritzFrog and the entire Botnet Encyclopedia.”

Botnets can be found within the encyclopedia using free-text search, allowing users to search all entries using any type of indicator of compromise (IOC) – IP addresses, domains, file names, names of services and scheduled tasks, and more. Extending beyond common cyber threat intelligence feeds and services, the Botnet Encyclopedia contextualizes advanced threats with tiered analysis including:

● Campaign information including name, variants, time frame of identification within the GGSN and links to external resources detailing the campaign.
● IOCs associated with the campaign including IP addresses from which attacks originate, IPs and domains holding outgoing attack connections, and files dropped or created as part of the attack.
● Full attack flow as it was captured and saved by the GGSN, accompanied by detailed analysis from Guardicore Labs’ global team consisting of hackers, researchers and industry experts.

“Winning the war against cybercrime cannot be achieved by any one individual or organization, it must be a collaborative global effort,” said Harpaz. “Threat intelligence and knowledge sharing has long been the cornerstone of such efforts. With the Botnet Encyclopedia, we are enhancing the ability for teams and organizations to turn intelligence into action with publicly accessible, deep context into the most dangerous campaigns targeting enterprises around the world; past, present and future.”

To learn more about the Botnet Encyclopedia, please visit: https://www.guardicore.com/botnet-encyclopedia/

About Guardicore
Guardicore is a data center and cloud security company that protects your organization’s core assets using flexible, quickly deployed, and easy to understand micro-segmentation controls. Our solutions provide a simpler, faster way to guarantee persistent and consistent security — for any application, in any IT environment. For more information, visit optimizeme.online.

Top-rated Open Source Tool Helps Security Teams Assess Readiness to Withstand Real Advanced Persistent Threats

Boston, Mass. and Tel Aviv, Israel – April 28, 2020 – Guardicore, a leader in internal data center and cloud security, today unveiled new capabilities for its open source Infection Monkey breach and attack simulation tool, used by thousands to review and analyze how their environments may be vulnerable to lateral movement and attacks. The latest version of Guardicore Infection Monkey now maps its actions to the MITRE ATT&CK knowledge base, providing a new report with the utilized techniques and recommended mitigations, to help security and network infrastructure teams simulate advanced persistent threat (APT) attacks and mitigate real attack paths intelligently.

“The MITRE ATT&CK knowledge base is a globally-recognized, comprehensive matrix of tactics and techniques observed in millions of actual attacks, used by enterprise network defenders to better classify attacks and assess risks,” said Pavel Gurvich, Co-founder and CEO, Guardicore. “By leveraging the universally accepted framework, Guardicore Infection Monkey is now equipped to help security teams quickly and safely test network defenses and how they map to specific advanced persistent threats. With clear and easy to understand reporting that identifies weak policies and provides prescriptive instructions to remedy them, Infection Monkey automates assessment of security posture and enables system tuning for better defense.”

Infection Monkey with MITRE ATT&CK Reporting
Increasingly, cybersecurity experts and enterprise DevSecOps teams use the publicly available, MITRE-developed ATT&CK framework as a basis for network security tests and assessments. Already deployed by Guardicore Infection Monkey users in ATT&CK simulations, the latest version is now equipped to test specific ATT&CK techniques in order to provide more insight about how those techniques were used and to offer prescriptive recommendations on how to better protect the network. The end result is a platform where ATT&CK tests can be readily configured, automatically launched and results aggregated into a single, easy to read and digest report.

Guardicore Infection Monkey enables cybersecurity and infrastructure architects to automate testing of network defenses by attempting to communicate with machines residing in different segments of the enterprise network, demonstrating policy violations, and generating test results with actionable recommendations for remediation. With prescriptive reporting that can be easily implemented without any additional staff or education, Guardicore Infection Monkey offers security leaders the ability to illustrate where defenses fall short and the measures necessary to rectify them.

Availability & Contributions
Developed by Guardicore Labs, Guardicore Infection Monkey is an open source breach and attack simulation tool for securely and automatically testing the resiliency of private and public cloud environments. Developed under the GPLv3 license, Guardicore Infection Monkey source code is currently available from the GitHub repository. Added capabilities for ATT&CK features are available now for immediate download. Guardicore Infection Monkey is available for bare metal Linux and Windows servers, AWS, Azure, VMWare and Docker environments, and private clouds. For questions, suggestions and guidance join the Infection Monkey community.

About Guardicore
Guardicore is a data center and cloud security company that protects your organization’s core assets using flexible, quickly deployed, and easy to understand micro-segmentation controls. Our solutions provide a simpler, faster way to guarantee persistent and consistent security — for any application, in any IT environment. For more information, visit optimizeme.online.