phil muncaster

Is Interpol right?

This isn’t the first time that a call has gone out to change specific cyber crime terminology. Back in 2020, the National Cyber Security Centre (NCSC) led a largely successful push to change “black/whitelist” to the more racially neutral “denylist/allowlist”. The terms “black hat” and “white hat” are far less common today for similar reasons.

Why are RATs attractive?

It should come as no surprise that threat actors are targeting such tools in greater numbers. They offer a useful way to blend in with legitimate tooling and processes, in a similar way to living off the land (LOTL) attacks. Because remote access software is signed with trusted certificates, it won’t be blocked by anti-malware or endpoint detection and response (EDR) tooling.

How to mitigate remote access attacks?

CISA lists a range of host and network-based controls and policy/architectural recommendations that could help build resilience against such attacks.

How to sort out this mess?

In the absence of funding, it will be a tough ask to meet the recommendations set out by the NAO (see boxout). However, it is possible, according to the experts Assured Intelligence spoke to.