Cyfer Tech Blog

Sophos X-Ops Continues to Protect Against Advanced EDR Killers 

At Cyfer Tech, we understand that the cybersecurity landscape is constantly evolving, with attackers relentlessly developing new tools to bypass and disable security measures. Recently, Sophos X-Ops published an update about a persistent threat they’ve been tracking for years: an advanced toolset designed to sabotage endpoint detection and response (EDR) solutions, making it easier for ransomware gangs to carry out their attacks. This blog will explore the ongoing battle against this EDR killer, known as Poortry, and how Sophos X-Ops remains at the forefront of protecting organizations. 

The Evolution of Poortry: A Threat to EDR 

Poortry is a malicious kernel-level driver that, along with its loader application Stonestop, has been used by multiple ransomware groups to disable EDR software. Since Sophos first reported on Poortry in 2022, the developers behind this tool have continued to refine and enhance its capabilities, making it more difficult to detect and neutralize. Despite Microsoft’s efforts to close loopholes that allowed these drivers to be signed and trusted, the creators of Poortry have not been deterred. Instead, they have found new methods to bypass security measures and continue their attacks. 

How Poortry Works: A Deeper Dive 

To understand how Poortry operates, it’s important to know how Windows drivers function. Drivers in Windows operate at the kernel level, granting them access to critical system functions. Poortry exploits this by loading a malicious driver into the kernel, which then disables or modifies protection software. 

There are several ways Poortry developers bypass security checks: 

1.  Abusing Leaked Certificates: Attackers use stolen or compromised code-signing certificates from legitimate companies to sign their malicious drivers. These signed drivers can then be loaded onto a system, bypassing security checks. 
2.  Forging Signature Timestamps: By manipulating the signing process, attackers can create fake timestamps that allow their drivers to appear legitimate, even when the certificates used are outdated or revoked. 
3.  Exploiting Microsoft’s Attestation Signing Process: In some cases, attackers manage to get their malicious drivers signed by Microsoft itself, giving them a powerful, legitimate-looking signature. 

Poortry’s Impact on Ransomware Attacks 

Since its discovery, Poortry has been linked to several major ransomware families, including CUBA, BlackCat, Medusa, LockBit, and RansomHub. The tool’s developers have continuously adapted, using different methods to ensure that their drivers are signed and trusted. This persistence has made Poortry a significant threat to organizations worldwide. 

One of the more recent developments is Poortry’s ability to not only disable EDR software but also to completely delete critical EDR components. This new capability was first observed during an incident involving RansomHub ransomware, where Sophos X-Ops identified Poortry as a key tool in the attackers’ arsenal. 

Sophos X-Ops: Leading the Fight Against Advanced Threats 

Sophos X-Ops has been instrumental in uncovering and mitigating the risks posed by Poortry and other advanced threats. Through a combination of static and dynamic analysis, they have tracked the evolution of Poortry, from its early versions that simply disabled EDR software to its current iteration that can also delete files off disk. Their ongoing research and collaboration with Microsoft have led to the deactivation of accounts used to sign malicious drivers, disrupting the attackers’ operations. 

Protecting Your Organization with Cyfer Tech and Sophos 

At Cyfer Tech, we are committed to providing our clients with the best cybersecurity solutions available. Partnering with Sophos allows us to offer advanced protection against threats like Poortry. Sophos’ cutting-edge technology and expert threat intelligence ensure that your organization stays ahead of attackers. 

As threats continue to evolve, so must our defenses. By staying informed and working with trusted cybersecurity partners like Cyfer Tech and Sophos, you can protect your organization from even the most sophisticated attacks. 

Contact us today to learn more about how Cyfer Tech and Sophos can help safeguard your business from the latest cybersecurity threats. 

Cyfer Tech Celebrates Sophos’ Recognition as a 2024 Gartner Peer Insights Customers’ Choice for Network Firewalls and Endpoint Protection Platforms 

Cyfer Tech, a proud Sophos Gold Partner, is thrilled to announce that Sophos has been named a 2024 Gartner® Peer Insights™ Customers’ Choice for Network Firewalls and Endpoint Protection Platforms. This marks the third consecutive year that Sophos has been honored with this prestigious recognition, a testament to the unwavering trust and satisfaction of its customers. 

Consistent Excellence in Network Security 

In the 2024 Gartner Peer Insights Voice of the Customer Report for Network Firewalls, Sophos achieved an impressive 4.8/5.0 rating based on 377 verified customer reviews as of March 31, 2024. This is the highest number of reviews for any vendor in this category. Additionally, Sophos has been recognized with a Customers’ Choice distinction in five industry segments and is the sole vendor positioned in the Customers’ Choice Quadrant for the Services Industry segment. 

Here’s what customers are saying about Sophos Firewall: 

• “Bravo Sophos for this outstanding firewall solution; you make our life easier!” – Technical Engineer in the Media Industry 
• “Sophos Firewall empowers secure networks with robust protection and scalable solutions.” – Senior Manager, IT in the Banking Industry 
• “Sophos Firewall is the best option out there to stay ahead of the threats!” – Associate Manager in the Manufacturing Industry 
• “Sophos Firewall is a marvelous solution that protects us against zero-day threats.” – Security Engineer in the Media Industry 

Leading the Way in Endpoint Protection 

Sophos has also excelled in the 2024 Gartner Peer Insights Voice of the Customer Report for Endpoint Protection Platforms, earning a 4.8/5.0 rating from 682 reviews as of April 30, 2024. This is again the highest number of reviews among all vendors in this report. Sophos has been named a Customers’ Choice vendor in all 11 industry segments covered by the report. 

Customers praised Sophos Endpoint Protection for its unmatched security features: 

• “Sophos Endpoint provides the most robust anti-ransomware protection in the industry.” – IT Manager in the Manufacturing Industry 
• “Sophos Endpoint protection combines multiple prevention techniques to reduce the attack surface.” – IT Manager in the Education Industry 
• “Unmatched protection: Sophos Intercept X Endpoint delivers peace of mind.” – Network Administrator in the Manufacturing Industry 
• “Sophos Intercept X is one of the best products we have ever used.” – IT Admin in the Transportation Industry 

Why Choose Sophos? 

Sophos’ consistent recognition by Gartner Peer Insights reflects the company’s dedication to delivering cutting-edge cybersecurity solutions that meet the evolving needs of businesses across various industries. At Cyfer Tech, we are committed to providing our clients with the best in network security and endpoint protection through our partnership with Sophos. 

We encourage you to explore Sophos’ innovative products: 

• Sophos Intercept X Endpoint 
• Sophos Firewall 

For more information and resources, visit our IT Security page. 

About Cyfer Tech 

Cyfer Tech is a leading IT solutions provider and a trusted Sophos Gold Partner. We specialize in delivering comprehensive cybersecurity solutions tailored to protect businesses from ever-evolving threats. Our partnership with Sophos ensures that our clients receive the highest level of protection and support. 

Stay updated with the latest in cybersecurity by following our blog and connecting with us on LinkedIn. 

Enhancing Cybersecurity with Sophos ZTNA 2.1 

As a Sophos Gold Partner, Cyfer Tech is excited to share the latest advancements in cybersecurity from Sophos. The newly released Sophos ZTNA 2.1 is a game-changer for organizations looking to enhance their security posture and streamline their network access management. 

Key Features of Sophos ZTNA 2.1 

1. Support for On-Premise Microsoft Active Directory: Sophos ZTNA 2.1 introduces support for on-premise Microsoft Active Directory (AD) as an identity provider. This addition complements the existing cloud-based Microsoft Entra ID and Okta solutions. Organizations without cloud infrastructure can now leverage their in-house Microsoft AD system for authentication, providing a seamless and secure access management solution. The integration supports multi-factor authentication (MFA) through captchas or email OTPs, enhancing security further. 
2. Zero Downtime and Seamless Failover: One of the standout features of this release is the support for zero downtime and seamless failover between cloud points-of-presence. This ensures that in the event of an outage in the preferred gateway region, the system automatically transitions to the next closest regional gateway, maintaining uninterrupted ZTNA access. This capability is available for cloud gateways running on virtual platforms such as ESXi and Hyper-V and will soon be available for Sophos Firewall-integrated ZTNA Gateways with the release of firmware update v20 MR2 later this month. 
3. Enhanced Security: Sophos ZTNA 2.1.1 includes crucial security and vulnerability fixes. After updating to ZTNA 2.1, it is essential to apply the 2.1.1 update to ensure the highest level of security. These updates fortify the system against emerging threats, keeping your network secure and resilient. 

How to Get the Updates 

To take advantage of these new features, follow these steps: 

1. Gateway Image Updates: 

• Navigate to the gateways page on Sophos Central and look for the update notification. This is applicable to gateways hosted on ESXi and Hyper-V platforms. For gateways on Sophos Firewall, the update will be available with the firmware update v20 MR2. 
• Initiate or schedule the upgrade, which may take up to 30 minutes. 
• Once the gateway is back to the “Active” state, verify the gateway’s diagnostics console before proceeding to the next update. 

1. Security Update 2.1.1: 

• After updating to ZTNA 2.1, apply the 2.1.1 update for important security enhancements. 
• The upgrade to version 2.1.1 also takes around 30 minutes for a single node. Multi-node clusters will take proportionately longer. 
• Check the diagnostics console after the update to ensure all tests pass and resume resource access. 

Conclusion 

The Sophos ZTNA 2.1 update is a significant leap forward in providing robust, seamless, and secure network access management. By supporting on-premise Microsoft AD, ensuring zero downtime, and offering critical security enhancements, Sophos continues to lead the way in cybersecurity solutions. 

At Cyfer Tech, we are committed to helping our clients implement these cutting-edge technologies to protect their networks and data. For more information on how Sophos ZTNA 2.1 can benefit your organization, contact our team today!