Security firm SentinelOne recently found evidence of a new breaching program it called Furtim’s Parent. It is targeting energy companies and is seemingly state-sponsored. Once the malware breaches a system, it becomes a persistent threat.

The malware is designed to download other malware from a command-and-control server, which performs the actual criminal tasks inside the system. Furtim just breaks down the door.

Breaching Quietly

Once in, the malware seeks to gain privileged access and disable any existing protections. Furtim’s Parent does this by very stealthily testing for security initiatives such as firewalls, virtual machines, sandboxes and more. In fact, it does this so well and leverages such sophisticated techniques that its scope seems beyond an average cybercriminal’s effort.

CSO Online noted that if the malware recognizes security software or advanced detection tools, it has the ability to shut itself down. It can also adapt to the environment by limiting its functionality and even attempting to turn off antivirus programs.

The finesse of its efforts is one reason it is suspected to be a state-sponsored malware. Add in the fact that it is going after high-profile target and you get a threat that needs to be taken seriously.

Furtim’s Parent Provides a Wake-Up Call

In an email, Leo Taddeo, the chief security officer for Cryptzone, commented on the advanced nature of Furtim’s Parent.

“The report from SentinelOne states that the malware was developed to bypass traditional antivirus solutions, next-generation firewalls and even more recent endpoint solutions that use sandboxing techniques to detect advanced malware. This highlights the need for cybersecurity teams to look beyond detection and perimeter protection tools that are expensive, complex and fail to offer complete protection,” Taddeo said.

He added that the only solution is to invest in better security measures that go beyond static detection techniques. “In order to counter this type of sophisticated malware, we need to harden the interior of networks with strong user authentication and microsegmentation. These measures make it harder for malware to gain a foothold and propagate from internet-facing network segments to the inner core. They also make it more likely for detection and prevention tools to spot the malware and signal an alert to security teams.”

This kind of malware shows that the more important the system, the more it must be defended. State-sponsored malware is likely here to stay, and shoring up defenses against these advanced threats is key to avoiding potentially destructive downtime.