A recent addition to the roster of threat actors worth monitoring, WhiteArmor (W.A.) has shown a distinct interest in transportation and logistics companies since late October. With several large trucking and logistics companies claimed as victims, defenders across the industry should be on high alert for attacks of a similar nature by this adversary.
What We Know
Alleged victims published on WhiteArmor’s leak site include several household names: J.B. Hunt, Ryder, Echo Logistics, and most recently, Maersk. Maersk has not attributed its recent cyber incident to WhiteArmor, but its November 11 public statement, they indicated that the recent incident involved unauthorized access and data extraction from one of its local legacy systems from a previous acquisition.
“WhiteArmor came on the scene very recently, October of this year, and engage in very targeted attacks of vulnerable webservers. Several transportation companies, ranging from very large national fleets and logistics companies down to several smaller regional fleets targeted by this group since October.” – shared Ben Wilkens, director of cybersecurity for NMFTA, in a recent November 12 FreightWaves article.
Should these claims be confirmed, they will illustrate an important point: These are not small companies with limited security budgets. These are well-established firms with dedicated security teams backed by significant resources. This should serve as a warning to the industry at large that this threat actor presents a credible and significant threat.
WhiteArmor has been observed targeting vulnerable internet-facing web servers and is using AI tools to identify these vulnerabilities and speed up their attacks. They are focused on data exfiltration and extortion. To date, no malware family or encryptor has been validated, and definitive IOCs are not available.
Actions You Can Take
There are several actions that will reduce exposure to the types of attacks that this threat actor is engaged in:
- Prioritize the patching of exposed web applications and the underlying server software.
- Remove any unneeded or legacy internet-exposed systems, paying particular attention to systems that may have been introduced through mergers or acquisitions.
- Make sure that Endpoint Detection and Response (EDR) is deployed across all assets, and is actively monitored, particularly on internet-facing web servers.
- Log and investigate any unexpected processes launched by web services, unexpected or suspicious command execution or webshell creation.
- Monitor for unusual outbound connections.
- Restrict all administrative access to approved access paths.
- Rotate credentials, API keys, and service account secrets tied to internet-facing applications.
- Monitor leak sites, threat intelligence feeds and social media for brand mentions.
In addition to these, ensure that all web application logs, authentication logs and database logs are collected and correlated with EDR telemetry.
As this threat actor is focused on exfiltration for the purposes of extortion, egress monitoring and Data Loss Prevention (DLP) on all databases or document storage locations is vital. The extortion model that WhiteArmor is relying on depends on bulk exfiltration from these types of assets and data theft through application requests may not generate the kinds of new processes that will be picked up by EDR tools.
According to a ReliaQuest threat report, WhiteArmor has also claimed to have stolen an unnamed internal CRM application binary. Restrict all access to internal CRM applications and apply least privilege to related service accounts to limit data access in the event that a breach does occur.
Defensive measures are important to prevent these kinds of attacks, but it is equally important to prepare to manage an incident should one occur. Ensure that your response playbook is up to date and covers your communication plan and customer notification plan, as well as legal and insurance contacts.
If You Receive an Extortion Demand
Engage legal counsel and, if applicable, contact your cyber insurance provider prior to responding to the threat actor. Report incidents to CISA and the FBI’s Internet Crime Complaint Center at ic3.gov. Doing so can bring investigative support and helps build the intelligence picture that protects the rest of the industry.
Finally, share what you see through the NMFTA Threat Report Portal. Indicators and tactics from one fleet’s incident can be another’s early warning, and with no validated IOCs for this group yet, that kind of information sharing is one of the best defenses the industry has.
