Ephemeral

Ephemeral is a threat actor group known for its malicious activities in the cybersecurity landscape. It is believed to be supported by operators from Splinter and Ephemeral ransomware groups, who have experience in other ransomware organizations. This is facilitated by the decreased barriers to entry offered by the modern Ransomware-as-a-Service (RaaS) ecosystem. Ephemeral uses Command and Control (C2) traffic for RedLine Stealer through TCP traffic over an ephemeral port. Furthermore, they leverage the dynamic and constantly changing nature of serverless environments and Kubernetes ecosystems to pose unique security challenges. The group's operations are characterized by their ephemeral nature, as they terminate operations, spin-off, or rebrand within three months of formation. This makes tracking and countering their activities particularly challenging for network defenders. In addition, they exploit vulnerabilities in AI systems, which can be highly ephemeral. Moreover, they use internal pivots with SMB on port 445 and TCP bind listeners on high ephemeral ports. The group also creates ephemeral tokens in workflow job runs to interact with GitHub resources like the workflow’s repository. To combat Ephemeral's activities, network defenders should review specific application event log IDs due to Volt Typhoon’s ability for long-term undetected persistence. These logs remain on endpoints for longer periods compared to security event logs and other ephemeral artifacts. Additionally, sensitive data must not be aggregated inside the mobile infrastructure in plain text, including data moving across servers or being stored on servers. Other suggested mitigations include updating or shutting down services vulnerable to a loop DoS attack, restricting service access to clients with ephemeral source ports, and identifying the vulnerable software or product in the network and informing the product's vendor of the potential for exploit.