Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

2/9/2018
12:20 PM
Kelly Sheridan
Kelly Sheridan
Slideshows
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

8 Nation-State Hacking Groups to Watch in 2018

The aliases, geographies, famous attacks, and behaviors of some of the most prolific threat groups.
Previous
1 of 9
Next

(Image: NicoElNino via Shutterstock)

(Image: NicoElNino via Shutterstock)

The nation-state threat landscape is constantly shifting. Threat actors alter strategies, switch targets, change tools - and for organizations who need to defend against these groups, keeping track of the players can seem impossible.

Some hotbed regions are getting hotter, and some big-name actors are getting bigger. A perfect example is Fancy Bear (also known as APT28 and Sofacy), one of many groups believed to act out of Russia and Eastern Europe. The group is thought to be an arm of the Russian military intelligence agency GRU.

"[Fancy Bear] is probably the most famous group right now," says John Hultquist, FireEye director of intel analysis, who expects Fancy Bear will become even more brazen over the course of this year. Security experts point to Fancy Bear as the predominant threat group to watch in 2018 as it widens its bullseye to include more corporate targets.  

North Korea is another hotbed for cyberattacks. The North Korean regime has invested significant resources in its cyber capabilities and groups from the area have been linked to a variety of activity, from the infamous Sony breach, to WannaCry and cryptocurrency mining.

Here are the nation-state threat groups security researchers are watching most closely - and the aliases, geographies, behaviors, past attacks, and changing strategies related to each one.  

 

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Previous
1 of 9
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Jeff.schilling
100%
0%
Jeff.schilling,
User Rank: Author
2/9/2018 | 1:38:49 PM
Would have Added the Shadow Brokers to this list
I enjoyed this list, but feel like is was mostly focused on outed Russian and NKorean actors over the last year.  I would have definitely added the Shadow Brokers to this list.  The stolen tools they put out on the open market appear to be legite nation-state level tools that were easily weaponized, allegedly by one or more of the groups listed here, in WannaCry and NOTPetya.  Would definitely keep your threat research team focused on if any more of the tools they may have are dropped on the open market.  
7 Truths About BEC Scams
Ericka Chickowski, Contributing Writer,  6/13/2019
DNS Firewalls Could Prevent Billions in Losses to Cybercrime
Curtis Franklin Jr., Senior Editor at Dark Reading,  6/13/2019
Cognitive Bias Can Hamper Security Decisions
Kelly Sheridan, Staff Editor, Dark Reading,  6/10/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-12855
PUBLISHED: 2019-06-16
In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.
CVE-2013-7472
PUBLISHED: 2019-06-15
The "Count per Day" plugin before 3.2.6 for WordPress allows XSS via the wp-admin/?page=cpd_metaboxes daytoshow parameter.
CVE-2019-12839
PUBLISHED: 2019-06-15
In OrangeHRM 4.3.1 and before, there is an input validation error within admin/listMailConfiguration (txtSendmailPath parameter) that allows authenticated attackers to achieve arbitrary command execution.
CVE-2019-12840
PUBLISHED: 2019-06-15
In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges via the data parameter to update.cgi.
CVE-2019-12835
PUBLISHED: 2019-06-15
formats/xml.cpp in Leanify 0.4.3 allows for a controlled out-of-bounds write in xml_memory_writer::write via characters that require escaping.