Group-IB: Changing the Face of Cyber Security

In the age of cyber resilience, cybercriminals and APTgroups, too, are becoming smarter each day and are coming up with newer ways to mask their malicious activities. As organizations work to improve their cyber defences, threat actors have reacted by becoming more flexible and adaptable, bypassing some of the most sophisticated security infrastructures against all the odds. It’s no longer enough to just analyse what’s inside the network perimeter, but actively hunt for threats that are in the wild and attribute them in order to prepare for the unknown. To address this predicament, Group-IB— an expert in the cybersecurity arena —fights ‘fire with fire,’ utilizing some of its high-fidelity threat hunting & intelligence solutions, coupled with DFIR, anti-fraud and cyber investigation competencies.

Group-IB, a Singapore-based company, is one of the leading cybersecurity solution and service providers that helps in the detection, investigation and prevention of cyberattacks, online fraud, and IP protection. The company holds 17 years of experience in the field of cyberspace and assists banks and financial organizations, oil and gas companies, critical infrastructure facilities and telecom companies round the clock in any state of cyber incident emergency.

Group-IB has forged its experience with threat hunting & intelligence expertise to create an ecosystem of highly sophisticated software and hardware solutions designed to monitor, identify, and prevent cyber threats. From day one, Group-IB’s specialists have painstakingly pieced together a unique knowledge base about hackers, cybercriminal groups, their tactics, and infrastructure, gathered during incident response operations and cyber investigations.

“There are millions of indicators like hashes, IPs, certificates. They are the dots; they do not bring you much value while connecting those dots and attributing them to a specific threat actor is paramount. It gives you a bigger picture and understanding of the depth of the attacks and adversaries’ further intent, based on historical data,” says Dmitry Volkov, CTO of Group-IB. “Since the very beginning, we have been observing different threat actors and how they bring down some of the highly robust IT infrastructures, which has enabled us to progressively learn, develop an excellent understanding of their behaviour, tools, techniques and practices and formulate security prerequisites needed for resilient and effective cyber defence.”

The passionate group of experts at Group-IB offer comprehensive protection for IT infrastructures based on the client’s demand and the in-depth analysis of attacks and incident response. The company’s product portfolio comprises a wide range of cyber threat detection services and solutions that prevent oppressive cybercrimes and safeguard any organizational assets. Unlike other vendors, Group-IB’s solutions identify threat actors through numerous indicators and can see their attacks at the preparation stage. The firm’s understanding of specific threat attributes associated with criminal groups or individuals proves to be a vital factor that gives the company a competitive advantage while combating or preventing sophisticated cyberattacks. A noteworthy benefit of employing Group-IB’s solution set is the added benefit of correlating multiple data sources to form a collective intelligence that empowers clients with the much-needed cyber resilience against looming threats.

Exemplifying the merits of his organization’s products, Volkov narrates a use case of safeguarding corporate infrastructure with Group-IB Threat Detection System (TDS). The CTO says, “While doing incident response, Group-IB experts always employ TDS sensors, which helps to not waste time on diving into peculiarities of SIEM configuration settings, for example. During a recent incident response in APAC, TDS helped identify multi infection processes that lasted for years - the organization had suffered several malicious campaigns by the Ocean Lotus APT-group.” Thus, TDS Huntbox automatically accessed data from Group-IB Threat Intelligence system, which stores information about past and ongoing attacks, and correlated it with that particular incident. This enabled Group-IB experts to create the network map showing compromised hosts, which included domain controller, a couple of abandoned servers and several workstations. The identification of the compromised hosts and accounts, the reconstruction of the attack chronology, as well as the detection of the attackers’ infrastructure have enabled Group-IB experts to kick the cybercriminals out of the corporate network and ensure its cyber resilience for months ahead. Volkov recollects how his firm managed to safeguard numerous clients against such attacks, effectively nullifying the efforts of threat actors on a global scale.

To further enhance its value proposition, Group-IB is working closely with law enforcement worldwide in order to hinder the work of attackers and fraudsters and facilitate the resolution of clients' problems in the most efficient and speediest manner. As a matter of fact, the company has nurtured a group of experienced employees who possess extensive knowledge in cyber investigation, threat hunting, and data science. Collectively, Group-IB aspires to create a knowledge and resource pool of threat intelligence, in turn, always remaining a step ahead of the threat actors.