UnknownCyber Solutions for the Public Sector

UnknownCyber Hunt for Volt Typhoon

UnknownCyber Hunt for Volt Typhoon (Proactive Hunt-MDR) enables your team to be proactive and remove unknown Volt-Typhoon tools from critical infrastructure.

CISA, NSA, and FBI have determined that Volt-Typhoon, a PRC State-Sponsored Actor, has successfully infiltrated U.S. critical infrastructure.

Compromises linked to Volt-Typhoon have targeted Communications, Energy, Transportation Systems, and Water and Wastewater Systems sector organizations’ IT networks. Some victims are smaller organizations with limited cybersecurity capabilities that provide critical services to larger organizations or key geographic locations.

Many organizations lack a threat hunting capability and the necessary resources to find and remediate threats that have penetrated their other solutions. Lack of personnel and specialized skillsets make it difficult for network defenders to discern legitimate behavior from malicious behavior, conduct analytics, and perform proactive hunting.

UnknownCyber Hunt for Volt Typhoon fills this gap, providing security teams custom hunt signatures for several Volt-Typhoon tools. These signatures are created from the actual bytecode of the tools used by Volt-Typhoon. Enabled by UnknownCyber’s patented method that hunts through bytecode; UnknownCyber hunt for Volt-Typhoon provides an information advantage in detection and hunt where other solutions fail.

Critical Infrastructure leaders should ask their security teams what proactive hunting measures have been employed to proactively detect Volt-Typhoon.

Conventional IOCs contained in the CISA advisory are insufficient to fully eradicate Volt-Typhoon. The CISA recommendations for “DETECTION/ HUNT” specify the need for a proactive strategy to mitigate cyber threats which enables proactive hunting. This echoes NSA’s guidance to “continuously hunt for network Intrusions.”

UnknownCyber Hunt for Volt Typhoon arms you team with an easy to deploy proactive hunt capability that is made affordable through automation and AI.

Please ask about our State and Local Cybersecurity Grant Program Resources to help you access federal funding to protect our critical infrastructure. Hunt today!

UnknownCyber Hunt-on-Demand

UnknownCyber Hunt-on-Demand (Proactive Hunt-MDR) enables your team to be proactive, hunt, and remove specific undetected threats by name or industry sector from critical infrastructure.

Many organizations lack a threat hunting capability and the necessary resources to find and remediate threats that have penetrated their other solutions. Lack of personnel and specialized skillsets make it difficult for network defenders to discern legitimate behavior from malicious behavior, conduct analytics, and perform proactive hunting.

UnknownCyber Hunt-on-Demand fills this gap by providing security teams custom hunt signatures for a specific threat or the top threats we are observing in a particular sector. These signatures are created from the actual bytecode of the tools used by advanced threat actors. Enabled by UnknownCyber’s method of creating rules that hunt bytecode; UnknownCyber Hunt-on-Demand provides an information advantage in detection other security tools cannot.

Critical Infrastructure leaders should ask their security teams what proactive hunting measures have been employed to mitigate threats that have already evaded their other security tools.

Make your organization proactive with UnknownCyber and easily implement a strategy that enables analytics and proactive hunting as recommended in best practices by CISA and industry leaders.

UnknownCyber Hunt-on-Demand mitigates unacceptable cyber risk by affording your team an affordable option for your team to easily implement a proactive strategy.

Please ask about our State and Local Cybersecurity Grant Program Resources to help you access federal funding to protect our critical infrastructure. Hunt today!

UnknownCyber Deep-90

UnknownCyber Deep-90 (Proactive Hunt-MDR Subscription)

Unknown Cyber Deep-90 makes it affordable to follow NSA guidance and “continuously hunt for network intrusions” in your critical infrastructure by automating highly trained hunt talent at scale through AI! With our comprehensive 90 day signature catalog curated by our AI powered Threat Library and 418 Intelligence, you can hunt your infrastructure for the newest and next threat variants so boards can demonstrate CISA recommended best practices and implement strategy that is truly proactive.

Hashes and Behavior are pro-tanto but not proactive!

“Automated detection methods, such as Intrusion Detection Systems (IDS), Endpoint Detection and Response (EDR) capabilities, and Security Information and Event Management (SIEM) system alerts are useful, but they cannot detect all breaches. Organizations that continuously hunt for anomalous network activity assume that malicious actors have by-passed automated detection and already reside in the network.”

Moving from People to Automation:

UnknownCyber’s Deep-90 enables your team to be proactive, hunt, and remove undetected threat actors from critical infrastructure.

Problem:

Many organizations lack a threat hunting capability and the necessary resources to find and remediate threats that have penetrated their other solutions. Lack of personnel and specialized skillsets make it difficult for network defenders to discern legitimate behavior from malicious behavior, conduct analytics, and perform proactive hunting.

Solution:

UnknownCyber Deep-90 fills this gap by providing security teams a collection of custom hunt signatures for the top threat being experienced in industry and continuous signature updates to remain proactive to new variants every day! UnknownCyber hunt signatures are created from the actual bytecode of the tools used by advanced threat actors. Enabled by UnknownCyber’s DoD developed method of creating rules that hunt bytecode; Deep 90 provides an information advantage in detection other security tools cannot.

Lead with Proactive Strategy:

Critical Infrastructure leaders should ask what proactive hunting measures have been employed to mitigate threats that have already evaded their other security tools.

Make your organization proactive with UnknownCyber and easily implement a strategy that enables analytics and proactive hunting best practices used by government and industry leaders! UnknownCyber’s Deep-90 mitigates unacceptable cyber risk by enabling your team to easily be proactive and get ahead of the adversary.

Please ask about our State and Local Cybersecurity Grant Program Resources to help you access federal funding to protect our Critical Infrastructure. Hunt today!

UnknownCyber Incident Response Plan Validation

Validate your organization’s Incident Response Plan or start with our template that incorporates UnknownCyber’s proactive defense.

An Incident Response Plan is a written document, formally approved by the senior leadership team, that helps your organization before, during, and after a confirmed or suspected security incident. Your Incident Response Plan will clarify roles and responsibilities and will provide guidance on key activities. It should also include a list of key people who may be needed during a crisis.

At a minimum establishing an incident response capability should include the following actions:

• Creating an incident response policy and plan
• Developing procedures for performing incident handling and reporting
• Setting guidelines for communicating with outside parties regarding incidents
• Selecting a team structure and staffing model
• Establishing relationships and lines of communication between the incident response team and other groups, both internal (e.g., legal department) and external (e.g., law enforcement agencies)
• Determining what services the incident response team should provide
• Staffing and training the incident response team

Please ask about our State and Local Cybersecurity Grant Program Resources to help you access federal funding to protect our critical infrastructure.

UnknownCyber Incident Response

Bad News Doesn’t Get Better With Time:

Hunting for intrusions involves proactively searching for evidence of cyber intrusions and then remediating any issues quickly so you can eradicate threats sooner and prevent further damage to your organization.

Identify/Contain:

When hunting leads to detection, Incident Response activities can help minimize data loss, mitigate vulnerabilities, and restore compromised services. When an incident occurs, the incident response team assesses the target and scope of the attack, and any vulnerabilities enabling it. Once an incident has been detected and reported—and the evidence collected—the threat must be contained to prevent it from spreading through the organization’s network and critical infrastructure.

Investigate/ Eradicate:

With UnknownCyber Incident Response investigations are accelerated allowing organizations to declare incidents earlier and win the time fight. Proaction reduces the risk of ransom, data exfiltration, and compliance penalties. UnknownCyber’s Incident Response Services deliver the critical factors of speed and accuracy to minimize incident-caused damage and limit the potential for further harm. UnknownCyber provides these services right-sized for organizations that wish to hunt but do not have a security team with the tools and specialized skillsets needed for a declared incident. With UnknownCyber you receive a marked advantage in eradicating the adversary beyond other threat intelligence and traditional IoCs because UnknownCyber provides an unmatched ability to detect new variants through code despite years of obfuscation. This augments traditional investigation and eradication allowing the removal of threats unknown to other solutions.

Recovering/ Restoring:

UnknownCyber’s Incident Response Services specialize in getting your organization back to its business. Downtime can have fatal impacts on revenue when businesses are unable to service customers for days. The average downtime after a ransomware attack is 22 days and the cost of this downtime averages $53,000 per hour. It pays to hunt early!

Downtime alone is motive enough for the PRC’s attacks on critical infrastructure. FBI Director Wray describes these attacks as “lying in wait for the moment China might choose to use their access to hurt American civilians.” CISA Director Jen Easterly echoed, “the threat is not theoretical, as CISA teams have found and eradicated Volt Typhoon intrusions into critical infrastructure across multiple sectors. And that’s likely “the tip of the iceberg.”

PRC hackers are positioning on American infrastructure in preparation to wreak havoc and create domestic confusion. Best practices would compel any fiduciary to advise their organizations to adopt proactive tools, now economically feasible through UnknownCyber’s automation, to hunt, assure, and eradicate today. This to ensure that if an incident has already occurred infrastructure operators know in sufficient time so they can restore the affected systems to their pre-incident state in an orderly environment with the least impact to their business processes. Douglas McArthur’s words to avoid failure ring true today. ‘Too late.’ Too late in comprehending the deadly purpose of a potential enemy. Too late in realizing the mortal danger. Too late in preparedness.”

Get Ahead of the Adversary!

Please ask about our State and Local Cybersecurity Grant Program Resources to help you access federal funding to protect our critical infrastructure.

UnknownCyber Managed Services

UnknownCyber offers annual or monthly subscriptions to Managed Services. Customers can add UnknownCyber’s subscription services to their existing solutions and pivot to proactive protection against unknown threats that get passed other defenses. With UnknownCyber in your security stack you continuously hunt for network intrusions and stay ahead of the adversary using the detections from your other managed services to sense and harden against attackers that are learning from their own failed attacks to penetrate your defenses. UnknownCyber’s subscription services create customized signatures for proactive predictive protection from the actual threats that are targeting your organization’s infrastructure. This custom threat intelligence is delivered along with curated industry wide proactive hunts to provide the best intelligence for a proactive defense at a scale that cannot be achieved with human analysis.

Get Ahead of the Adversary and own the Unknown!

Please ask about our State and Local Cybersecurity Grant Program Resources to help you access federal funding to protect our critical infrastructure.