Belkasoft X Corporate

Several days before the important product release, the related documents leaked to the US tech press. The documents were available through the intranet to around 50 employees of different departments within 7 offices worldwide. You suspect that one of your employees has “leaked” key details of the new product to your competitors and you want to determine who it was.

Belkasoft X has the ability to collect images of employees' computers, laptops, and corporate mobile devices both remotely and on-site. It analyzed not only existing files but also recovered data that was deleted or hidden using various technical tricks. Once the analysis was completed, a keyword search related to the new product was applied to identify all communications containing those words. This determined whether these were external communications or communications out of the allowed circle of persons having access to it.

The employee from an engineering team in the Singapore office downloaded the documentation and shared it with a colleague from the marketing department. This colleague then transferred it to a personal device through a USB flash drive and uploaded it to the press representative via WeTransfer.

An employee's system was compromised by malware called k0adic. The task was to figure out how k0adic reached the target and repair the vulnerability.

Belkasoft's incident investigation software Belkasoft N was used to detect the main traces of the malicious code: methods of its anchoring in the system, IP addresses the computer communicated with, the last opened documents, and downloaded files (to determine the initial attack vector), etc.

It was determined that k0adic infiltrated the system through an email attachment. The malware used WMI subscriptions, scheduled tasks, and other services to anchor inside and establish the remote connection. The IP address for the connection and an earlier attempt of the attack were detected. As a result, the security guidelines for employees were updated, and access rights were limited for multiple employees. Multiple further attacks have since been prevented.

Due to the rise of digital nomad culture and a growing number of remote workers in the company, regular data acquisition and analysis on remote devices should be part of the preventive measures in a corporate environment with more than 200 remote employees to improve their cybersecurity.

Belkasoft R was used to regularly acquire data from remote workers' devices and create RAM images to analyze and detect anomalies in employees' behavior and the possibilities of malicious code.

The weekly checkups of employees' devices and networks helped to detect the usage of forbidden cloud storage services and untrusted software with poor security standards, prevent data breaches, malware integration, and unintended risky behavior of "nomadic" employees.