Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

10/30/2018
05:30 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Destructive Cyberattacks Spiked in Q3

Instead of simply fleeing when discovered, adversaries are actively engaging with incident response teams, a new Carbon Black study finds.

New data gathered from more than three dozen providers of incident response services reveals a disturbing increase in the past quarter of destructive cyberattacks targeting US organizations.

What is not clear is whether the attacks—many of them from countries like China, Russia, and North Korea—are a response to the current geopolitical climate, or demonstrate increasingly punitive attempts by attackers to hide their tracks after being discovered.

Either way, the implications of the trend are serious for enterprises, says Tom Kellermann, chief security officer at Carbon Black, the security vendor behind the report. Between the second and third quarters of this year, there was a three-fold increase in destructive attacks where adversaries deleted or encrypted data, destroyed logs and backups, and caused system outages in ways designed to paralyze victims.

Thirty-two percent of the breaches that the 37 incident responders in Carbon Black's study investigated last quarter involved such attacks compared to 10% in the second quarter.

Compounding the severity of the situation was the fact that more than 50% of the attacks that the IR firms investigated involved so-called "island hopping," Kellermann says. These are attacks where threat actors target an organization so they can access an affiliate's network, like that belonging to a customer or partner. Thirty percent of victim organizations in the Carbon Black study saw their websites being turned into a watering hole by adversaries seeking to attack and associated company's network, he notes.

"Enterprises need to understand how their biggest customers and partners could be indirectly targeted either from or through their infrastructure," Kellerman says. "They need to do a better job of understanding East-West movement and do hunts and incident response in a more clandestine manner."

A lot of the data destruction and system disruption that incident responders encountered last quarter appears to be a manifestation of counter-incident response tactics by attackers.

Hackers Hacking IR

Instead of simply fleeing when discovered, many threat actors are instead actively engaging with incident responders and deploying counter measures of their own. In 51% of the incidents that IR providers investigated last quarter, adversaries attempted to erase antivirus and security logs and block IR teams from critical forensic data. More than four in ten organizations that experienced a security incident last quarter reported finding a secondary command and control (C2) passageway on their network that was triggered to wakeup if the primary C2 was discovered.

"We are dealing with more of an insurgency within our infrastructure," Kellermann says. "The louder or more active we become with our countermeasures, the more punitive," attackers are likely to get.

The fact that a substantial proportion of destructive attacks emanated from groups within countries currently at odds with the US make it possible that at least some of them are geopolitically motivated, Kellermann adds. Groups within China and Russia, for instance, accounted for 47% of all cyberattacks that IR providers responded to last quarter.

Interestingly, more than two-thirds of incident responders believe that groups from these countries will attempt to influence the US midterm elections via cyberattacks.

For enterprises, the trend towards more destructive attacks highlights the need to pay attention to incident detection and response. Organizations that haven't already done so should conduct a threat-hunting exercise to find potentially compromised assets, Kellermann says. Optimally, such exercises need to be conducted on a regular basis.

Also important are endpoint threat assessments and penetration tests from outside the enterprise infrastructure, and inside as well to detect potential paths that attackers could take to get to other affiliate networks. Use of deception technologies and out-of-band communication methods can also be useful in helping enterprises hide their incident response activity and not tip their hand off to the attackers, he says.

Related Content:

 

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Attackers Leave Stolen Credentials Searchable on Google
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2021
How to Better Secure Your Microsoft 365 Environment
Kelly Sheridan, Staff Editor, Dark Reading,  1/25/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: I can't find the back door.
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-21275
PUBLISHED: 2021-01-25
The MediaWiki "Report" extension has a Cross-Site Request Forgery (CSRF) vulnerability. Before fixed version, there was no protection against CSRF checks on Special:Report, so requests to report a revision could be forged. The problem has been fixed in commit f828dc6 by making use of Medi...
CVE-2021-21272
PUBLISHED: 2021-01-25
ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a "zip-slip" vulnerability. The directory support feature allows the ...
CVE-2021-23901
PUBLISHED: 2021-01-25
An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions < 1.18. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML ...
CVE-2020-17532
PUBLISHED: 2021-01-25
When handler-router component is enabled in servicecomb-java-chassis, authenticated user may inject some data and cause arbitrary code execution. The problem happens in versions between 2.0.0 ~ 2.1.3 and fixed in Apache ServiceComb-Java-Chassis 2.1.5
CVE-2020-12512
PUBLISHED: 2021-01-22
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated reflected POST Cross-Site Scripting