Belkasoft
for Corporate Investigations

Challenge: An employee's system was compromised by malware called k0adic. The task was to figure out how k0adic reached the target and repair the vulnerability.

Solution: Belkasoft's incident investigation software Belkasoft N was used to detect the main traces of the malicious code: methods of its anchoring in the system, IP addresses the computer communicated with, the last opened documents, and downloaded files (to determine the initial attack vector), etc.

Result: It was determined that k0adic infiltrated the system through the email attachment. The malware used WMI subscriptions, scheduled tasks, and other services to anchor inside and establish the remote connection. The IP address for the connection and an earlier attempt of the attack were detected. As a result, the security instruction for employees was updated, and access rights were limited for multiple employees. Multiple further attacks have since been prevented.

Challenge: Due to the rise of digital nomad culture and a growing number of remote workers in the company, preventive measures such as regular remote devices data acquisitions and analyses, should be taken in a corporate environment with more than 200 remote employees to improve their cybersecurity.

Solution: Belkasoft R was used to regularly acquire data from remote workers' devices and create RAM images to analyze and detect anomalies in employees' behavior and the possibilities of malicious code.

Result: The weekly checkups of employees' devices and networks helped to detect the usage of forbidden cloud storage services and untrusted software with poor security standards, prevent data breaches, malware integration, and unintended risky behavior of "nomadic" employees.