Stopping Coordinated Attacks from Mumbai | Application Detection & Response | Contrast Security

Over one weekend, Contrast detected 87 coordinated attacks originating from infrastructure in Mumbai, India that targeted the usually dangerous blind spot between perimeter defenses and application runtimes. This type of complex attack is why organizations use Contrast Application Detection and Response. This campaign, launched on October 18th and 19th, is a textbook demonstration of the sophisticated, multi-vector TTPs used by modern adversaries who understand how to exploit the problem in most organizations. There’s no real-time visibility into runtime application attacks or the ability to stop them.  
This was not a theoretical test or customer incident; the attacks targeted Contrast itself. Because we saw the full attack chain firsthand, we can show exactly how ADR detects, interprets, and blocks what others miss.

Contrast Labs has put together this analysis of the observed attack progression – from initial reconnaissance and shell command execution to framework-specific RCE and credential harvesting – as a critical case study for defense teams.  Read on for a phase-by-phase reconstruction showing how these attackers weaponized obfuscation and in-process execution to evade WAFs and EDRs, and the runtime signals that flagged them.

*** This is a Security Bloggers Network syndicated blog from AppSec Observer authored by Naomi Buckwalter. Read the original post at: https://www.contrastsecurity.com/security-influencers/48-hour-case-study-analyzing-coordinated-attacks-from-mumbai-india

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts