- Red Sky released Fusion Report 12-004 this week. Red Sky analysts reported an entire European Class C as malicious and the addresses used for a shell game. We found it during analysis of a Banking/Finance submission. The report offered full malware analysis and details of the Class C Subnet being used in the attacks. The submitter stated the Red Sky analysis was some of the best they'd seen. The analysis was performed using multiple sources, starting with the attack data as the trigger followed by fusing open source intelligence information with corroboration from a product called ScoutVision. Multiple sources make for higher confidence assessments. The company blocked the Class C and requested permission to share the analysis with the the FS-ISAC's Threat Intelligence Center. Since the incident affected only this company we agreed.
- On April 3rd about 9PM UTC a Fortune 100 defense industry member reported spearphishing with "UPS C2". We know this TTP. While the company responded to the incident, Red Sky members performed analysis of malware, began victim notification/coordination with C2 and exfil machine owners, and coordinated identification of contact points from those companies where we had none. The submitter stated "nobody else offers this kind of service!". Red Sky knows the value of standing up command and control during incident response, but in this case the simple act of offering another set of eyeballs and external coordination went a long way. We called another well known company to tell them they'd had three machines being used in the attack. When the Director of Incident Response answered the phone, I stated my name and that I was with the Red Sky Alliance. She immediately said "I've heard of you. I think think this is something we should be involved in."
- Associate members Kyrus-Tech, Norman ANA, LookingGlass now have dedicated analysts participating in Red Sky. All proved their value week, and two have a new customer as a result. Vendors are welcome to join as Associate Members. Associate members pay a fee, participate in analysis, and are peer reviewed by readers just like any other member. Selling inside the portal is never allowed but if vendors really can do what they say, this is where they get to prove it. These companies are proving it; the Red Sky membership is benefiting from the great analysis; and the vendors are earning new customers. It's a win-win-win.
- This week Red Sky hired two new student interns and we're expecting a decision from a third by early this week. Two of the interns are Masters Degree students with the third a PhD. One will perform fusion report analysis, but the others are political science and criminal justice students (MS and PhD) who will begin authoring non-technical reports on targeting and trends. They'll be bringing experiences from studying violent criminal gang activities to the cyber realm!
Jeff
