Attacks/Breaches

2/9/2018
12:20 PM
Kelly Sheridan
Kelly Sheridan
Slideshows
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

8 Nation-State Hacking Groups to Watch in 2018

The aliases, geographies, famous attacks, and behaviors of some of the most prolific threat groups.
Previous
1 of 9
Next

(Image: NicoElNino via Shutterstock)

(Image: NicoElNino via Shutterstock)

The nation-state threat landscape is constantly shifting. Threat actors alter strategies, switch targets, change tools - and for organizations who need to defend against these groups, keeping track of the players can seem impossible.

Some hotbed regions are getting hotter, and some big-name actors are getting bigger. A perfect example is Fancy Bear (also known as APT28 and Sofacy), one of many groups believed to act out of Russia and Eastern Europe. The group is thought to be an arm of the Russian military intelligence agency GRU.

"[Fancy Bear] is probably the most famous group right now," says John Hultquist, FireEye director of intel analysis, who expects Fancy Bear will become even more brazen over the course of this year. Security experts point to Fancy Bear as the predominant threat group to watch in 2018 as it widens its bullseye to include more corporate targets.  

North Korea is another hotbed for cyberattacks. The North Korean regime has invested significant resources in its cyber capabilities and groups from the area have been linked to a variety of activity, from the infamous Sony breach, to WannaCry and cryptocurrency mining.

Here are the nation-state threat groups security researchers are watching most closely - and the aliases, geographies, behaviors, past attacks, and changing strategies related to each one.  

 

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Previous
1 of 9
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Jeff.schilling
100%
0%
Jeff.schilling,
User Rank: Author
2/9/2018 | 1:38:49 PM
Would have Added the Shadow Brokers to this list
I enjoyed this list, but feel like is was mostly focused on outed Russian and NKorean actors over the last year.  I would have definitely added the Shadow Brokers to this list.  The stolen tools they put out on the open market appear to be legite nation-state level tools that were easily weaponized, allegedly by one or more of the groups listed here, in WannaCry and NOTPetya.  Would definitely keep your threat research team focused on if any more of the tools they may have are dropped on the open market.  
RIP, 'IT Security'
Kevin Kurzawa, Senior Information Security Auditor,  11/13/2018
Empathy: The Next Killer App for Cybersecurity?
Shay Colson, CISSP, Senior Manager, CyberClarity360,  11/13/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: I spy, you spy, we all spy...a spy...
Current Issue
Flash Poll
Online Malware and Threats: A Profile of Today's Security Posture
Online Malware and Threats: A Profile of Today's Security Posture
This report offers insight on how security professionals plan to invest in cybersecurity, and how they are prioritizing their resources. Find out what your peers have planned today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-19367
PUBLISHED: 2018-11-20
Portainer through 1.19.2 provides an API endpoint (/api/users/admin/check) to verify that the admin user is already created. This API endpoint will return 404 if admin was not created and 204 if it was already created. Attackers can set an admin password in the 404 case.
CVE-2018-19335
PUBLISHED: 2018-11-20
Google Monorail before 2018-06-07 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download times (for requests with a crafted groupby value) can be used to obtain sensitive information about the content of bug reports.
CVE-2018-19334
PUBLISHED: 2018-11-20
Google Monorail before 2018-05-04 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download times (for requests with an unsupported axis) can be used to obtain sensitive information about the content of bug reports.
CVE-2018-10099
PUBLISHED: 2018-11-20
Google Monorail before 2018-04-04 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download times (for requests with duplicated columns) can be used to obtain sensitive information about the content of bug reports.
CVE-2018-17906
PUBLISHED: 2018-11-19
Philips iSite and IntelliSpace PACS, iSite PACS, all versions, and IntelliSpace PACS, all versions. Default credentials and no authentication within third party software may allow an attacker to compromise a component of the system.