Open Knowledge Base of Persistent Botnet Threats Helps Security Teams Turn Intelligence Into Action; Unknown Decentralized Worm Discovered Upon Launch

Boston, Mass. and Tel Aviv, Israel – June 30, 2020 – Guardicore, a leader in data center and cloud security, today announced that its global research division, Guardicore Labs, has launched the Botnet Encyclopedia. Guardicore’s Botnet Encyclopedia provides a continuously updated universal knowledge base of past and present botnet campaigns researched by the Labs team – many of which previously unknown to the cybersecurity community – showcasing the greatest threats to enterprise security in a single, open location.

The Botnet Encyclopedia is powered by the Guardicore Global Sensors Network (GGSN), a network of detection sensors deployed in data centers and cloud environments around the world, capable of capturing and recording complete attack flows to the highest resolution. The Botnet Encyclopedia is designed to allow security teams, IT teams, researchers and the cybersecurity community at large to better understand and protect themselves from persistent and advanced threats, identified as campaigns.

FritzFrog, a mass-scale attack campaign active since January 2020 in which a sophisticated Golang binary is deployed on brute-forced SSH servers, is one of the first Botnet Encyclopedia campaign entries. Research identifies FritzFrog as a highly concerning peer-to-peer botnet with no centralized infrastructure, rather one whose control is distributed among its nodes. Its discovery as a decentralized worm makes it particularly unusual and dangerous. In addition, the research team identified racist terminology hard coded in the malware.

“FritzFrog is the type of threat that must be recognized as a campaign due to its operational longevity and danger it presents, particularly as a previously unknown threat,” said Ophir Harpaz, security researcher, Guardicore. “It’s our mission to bring these campaigns to light on a rolling basis and provide a level of context unavailable in any other public knowledge base in order to equip the cybersecurity community with the required information to defend itself and mitigate risk. Our research and analysis of FritzFrog is ongoing. We’ve been unearthing new findings into its enterprise impact and attacker attribution on a daily basis. We encourage all contributions, questions and suggestions from the community to enhance our findings into FritzFrog and the entire Botnet Encyclopedia.”

Botnets can be found within the encyclopedia using free-text search, allowing users to search all entries using any type of indicator of compromise (IOC) – IP addresses, domains, file names, names of services and scheduled tasks, and more. Extending beyond common cyber threat intelligence feeds and services, the Botnet Encyclopedia contextualizes advanced threats with tiered analysis including:

● Campaign information including name, variants, time frame of identification within the GGSN and links to external resources detailing the campaign.
● IOCs associated with the campaign including IP addresses from which attacks originate, IPs and domains holding outgoing attack connections, and files dropped or created as part of the attack.
● Full attack flow as it was captured and saved by the GGSN, accompanied by detailed analysis from Guardicore Labs’ global team consisting of hackers, researchers and industry experts.

“Winning the war against cybercrime cannot be achieved by any one individual or organization, it must be a collaborative global effort,” said Harpaz. “Threat intelligence and knowledge sharing has long been the cornerstone of such efforts. With the Botnet Encyclopedia, we are enhancing the ability for teams and organizations to turn intelligence into action with publicly accessible, deep context into the most dangerous campaigns targeting enterprises around the world; past, present and future.”

To learn more about the Botnet Encyclopedia, please visit: https://www.guardicore.com/botnet-encyclopedia/

About Guardicore
Guardicore is a data center and cloud security company that protects your organization’s core assets using flexible, quickly deployed, and easy to understand micro-segmentation controls. Our solutions provide a simpler, faster way to guarantee persistent and consistent security — for any application, in any IT environment. For more information, visit www.guardicore.com.

Top-rated Open Source Tool Helps Security Teams Assess Readiness to Withstand Real Advanced Persistent Threats

Boston, Mass. and Tel Aviv, Israel – April 28, 2020 – Guardicore, a leader in internal data center and cloud security, today unveiled new capabilities for its open source Infection Monkey breach and attack simulation tool, used by thousands to review and analyze how their environments may be vulnerable to lateral movement and attacks. The latest version of Guardicore Infection Monkey now maps its actions to the MITRE ATT&CK knowledge base, providing a new report with the utilized techniques and recommended mitigations, to help security and network infrastructure teams simulate advanced persistent threat (APT) attacks and mitigate real attack paths intelligently.

“The MITRE ATT&CK knowledge base is a globally-recognized, comprehensive matrix of tactics and techniques observed in millions of actual attacks, used by enterprise network defenders to better classify attacks and assess risks,” said Pavel Gurvich, Co-founder and CEO, Guardicore. “By leveraging the universally accepted framework, Guardicore Infection Monkey is now equipped to help security teams quickly and safely test network defenses and how they map to specific advanced persistent threats. With clear and easy to understand reporting that identifies weak policies and provides prescriptive instructions to remedy them, Infection Monkey automates assessment of security posture and enables system tuning for better defense.”

Infection Monkey with MITRE ATT&CK Reporting
Increasingly, cybersecurity experts and enterprise DevSecOps teams use the publicly available, MITRE-developed ATT&CK framework as a basis for network security tests and assessments. Already deployed by Guardicore Infection Monkey users in ATT&CK simulations, the latest version is now equipped to test specific ATT&CK techniques in order to provide more insight about how those techniques were used and to offer prescriptive recommendations on how to better protect the network. The end result is a platform where ATT&CK tests can be readily configured, automatically launched and results aggregated into a single, easy to read and digest report.

Guardicore Infection Monkey enables cybersecurity and infrastructure architects to automate testing of network defenses by attempting to communicate with machines residing in different segments of the enterprise network, demonstrating policy violations, and generating test results with actionable recommendations for remediation. With prescriptive reporting that can be easily implemented without any additional staff or education, Guardicore Infection Monkey offers security leaders the ability to illustrate where defenses fall short and the measures necessary to rectify them.

Availability & Contributions
Developed by Guardicore Labs, Guardicore Infection Monkey is an open source breach and attack simulation tool for securely and automatically testing the resiliency of private and public cloud environments. Developed under the GPLv3 license, Guardicore Infection Monkey source code is currently available from the GitHub repository. Added capabilities for ATT&CK features are available now for immediate download. Guardicore Infection Monkey is available for bare metal Linux and Windows servers, AWS, Azure, VMWare and Docker environments, and private clouds. For questions, suggestions and guidance join the Infection Monkey community.

About Guardicore
Guardicore is a data center and cloud security company that protects your organization’s core assets using flexible, quickly deployed, and easy to understand micro-segmentation controls. Our solutions provide a simpler, faster way to guarantee persistent and consistent security — for any application, in any IT environment. For more information, visit www.guardicore.com.

Leader in Data Center and Cloud Security Extends Global Reach with Operations in India; Cybersecurity Industry Veteran Pratik Sharma to Lead Guardicore India

Tel Aviv, Israel – March 9, 2020 – Guardicore, a leader in internal data center and cloud security, today announced the expansion of global operations, with the establishment of Guardicore Pvt. Ltd. in Mumbai, India. Guardicore India will be headed by Regional Director Pratik Raj Sharma, a cybersecurity industry veteran and former Regional Sales Director, Check Point, West India. 

“With a growing global customer base which includes some of the largest companies in North America, Europe and Latin America, and a significant portion of top financial institutions around the world, including Banco Santander, we see India as a major focus market,”said Dror Salee, Co-Founder and Vice President, Asia Pacific at Guardicore. “We have evidence there is a great need for easy to use, flexible and scalable micro-segmentation solutions in data centers across India’s large and fast-growing economy. We are already engaged with some of India’s largest companies and will be hiring local pre-sales, customer success and professional services engineers to support rapid growth in the country.”

Establishing a market presence in India, Guardicore further expands its global footprint to address increased market demand for its comprehensive data center and cloud security solution  Guardicore Centra, delivering the simplest way to apply micro-segmentation controls that reduce attack surface and detect and control breaches within complex internal corporate networks. Guardicore will support this expanded international presence with a dedicated team based in Mumbai, addressing customer demand through a high-value global channel partner program aimed at delivering award-winning cloud security to customers throughout Asia Pacific.

Pratik Sharma Heads up Guardicore India Pvt. Ltd.

Based in Mumbai, Guardicore India Pvt. Ltd. Regional Director Pratik Raj Sharma will lead Guardicore India, providing strategic direction, and leading the development and expansion of new business opportunities. Pratik is a security industry veteran with more than 18 years of experience. Pratik had been with Check Point Software for over 11 years, holding positions of Security Consultant, System Engineering Director India and SAARC, and most recently Regional Sales Director for Check Point, West India. Pratik has a proven record of facilitating long term business relationships with both customers and industry luminaries.  His market and technology experience and expertise are assets that will complement and enhance Guardicore’s ability to meet the data center and cloud security needs of large companies in India’s growing economy. 

About Guardicore

Guardicore is a data center and cloud security company that protects your organization’s core assets using flexible, quickly deployed, and easy to understand micro-segmentation controls. Our solutions provide a simpler, faster way to guarantee persistent and consistent security — for any application, in any IT environment. For more information, visit www.guardicore.com.

Guardicore Centra Version 5 Introduces Expanded Coverage for Cloud-Native Applications and PaaS and AI-Powered Segmentation

Boston, Mass. and Tel Aviv, Israel – February 21, 2020 – Guardicore, a leader in internal data center and cloud security, today announced several new capabilities in its Guardicore Centra Security Platform designed to help security architects visualize, segment, and protect cloud-native applications while further simplifying the process for reducing risk to mission-critical business applications through segmentation. 

Building on its broad security coverage across hybrid data center environments, Guardicore protects cloud-native applications, including serverless computing and Platform as a Service (PaaS). This enables security teams to visualize and control access to cloud-native applications from the same Guardicore Centra Security Platform where they secure applications running on bare metal systems, virtual servers, Infrastructure as a Service (IaaS) and containers. This provides security professionals with a single platform, giving them a single view of all applications and flows, and a single, consistent dashboard to create, update and enforce policies, dramatically simplifying security policy management in hybrid data center and cloud environments.

“Cloud-native application development is rapidly becoming the new standard for quickly building and scaling new business applications and optimizing existing ones,” said Pavel Gurvich, Co-founder and CEO, Guardicore. “Until now, providing adequate protection of PaaS services such as AWS S3, Azure SQL, and GCP Cloud Run has required standalone security tools to properly visualize access to these services and apply access control policies, resulting in inefficient security policy management across hybrid environments. Guardicore has simplified this by integrating cloud-native support into the Guardicore Centra Security Platform. This allows security to keep up with the pace of DevOps while maintaining the appropriate levels of security to protect sensitive data and applications.”

Security for Cloud-Native Applications

The Guardicore Centra Security Platform secures the production and operational elements of cloud-native applications by enabling IT security teams to visualize access to PaaS services, by  user, system or cloud service, providing a visual map of all interactions between those services, including application flows. Guardicore segmentation policies then control access to cloud resources to ensure only sanctioned users and systems are allowed, blocking any unauthorized access, and reducing the attack surface of cloud-native applications. 

Guardicore Centra uses multiple methods for data collection and policy enforcement for cloud-native applications, including cloud-native access control policies, cloud APIs, Guardicore agents, and utilizing code instrumentation mechanisms for serverless functions. This provides the ultimate flexibility in how to apply least privilege and reduce the attack surface of cloud-native services.

AI-Powered Segmentation

Whether deployed in existing on-premises data centers or in the cloud, segmenting applications often requires IT to manually classify assets and write segmentation rules to achieve the proper level of security. Guardicore already provides an intuitive, integrated workflow to minimize manual effort, but by leveraging AI, Guardicore Centra version 5 further accelerates and simplifies segmentation and ongoing policy management.  Guardicore Centra’s AI-powered segmentation makes asset classification even easier and reduces the time and effort needed to apply a segmentation policy to new or existing applications.

Based on intelligence collected from tens of thousands of applications and millions of flows from Guardicore customers, and combined with AI-based algorithms, Guardicore Centra provides asset classification and policy assistance in three main areas:

1. Automatic prioritization recommendations for application segmentation. Guardicore Centra automatically provides recommendations on which applications to segment first, based on Guardicore’s continuous analysis of the applications that represent the greatest risk reduction opportunities.
2. Scoping and classifying applications.  To help reduce or even eliminate manual processes for labeling assets and components of a particular application, Guardicore Centra automatically discovers, scopes and provides recommendations for how to label an application for easy and seamless classification.
3. Automatic segmentation policy recommendations. Guardicore Centra provides segmentation rule recommendations based on known application behavior and a pre-defined set of policy templates for common applications. For example, for Splunk users, Guardicore Centra will provide a pre-defined set of rules for securing this application with minimal to no human intervention. This provides a quick and easy way to reduce the risk without having to write new rules or rewrite rules for another application. 

Guardicore will preview new features at the RSA Conference in San Francisco, CA, February 24, 2020 – February 27 in Guardicore Booth #4319.

About Guardicore Centra

Guardicore Centra is a comprehensive data center and cloud security solution that delivers the simplest way to apply micro-segmentation controls to reduce the attack surface and detect and control breaches within east-west traffic. It provides deep visibility into application dependencies and enforces network and process-level policies to protect critical applications, in any environment.

About Guardicore

Guardicore is a data center and cloud security company that protects your organization’s core assets using flexible, quickly deployed, and easy to understand micro-segmentation controls. Our solutions provide a simpler, faster way to guarantee persistent and consistent security — for any application, in any IT environment. For more information, visit www.guardicore.com.