Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

10/30/2018
05:30 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Destructive Cyberattacks Spiked in Q3

Instead of simply fleeing when discovered, adversaries are actively engaging with incident response teams, a new Carbon Black study finds.

New data gathered from more than three dozen providers of incident response services reveals a disturbing increase in the past quarter of destructive cyberattacks targeting US organizations.

What is not clear is whether the attacks—many of them from countries like China, Russia, and North Korea—are a response to the current geopolitical climate, or demonstrate increasingly punitive attempts by attackers to hide their tracks after being discovered.

Either way, the implications of the trend are serious for enterprises, says Tom Kellermann, chief security officer at Carbon Black, the security vendor behind the report. Between the second and third quarters of this year, there was a three-fold increase in destructive attacks where adversaries deleted or encrypted data, destroyed logs and backups, and caused system outages in ways designed to paralyze victims.

Thirty-two percent of the breaches that the 37 incident responders in Carbon Black's study investigated last quarter involved such attacks compared to 10% in the second quarter.

Compounding the severity of the situation was the fact that more than 50% of the attacks that the IR firms investigated involved so-called "island hopping," Kellermann says. These are attacks where threat actors target an organization so they can access an affiliate's network, like that belonging to a customer or partner. Thirty percent of victim organizations in the Carbon Black study saw their websites being turned into a watering hole by adversaries seeking to attack and associated company's network, he notes.

"Enterprises need to understand how their biggest customers and partners could be indirectly targeted either from or through their infrastructure," Kellerman says. "They need to do a better job of understanding East-West movement and do hunts and incident response in a more clandestine manner."

A lot of the data destruction and system disruption that incident responders encountered last quarter appears to be a manifestation of counter-incident response tactics by attackers.

Hackers Hacking IR

Instead of simply fleeing when discovered, many threat actors are instead actively engaging with incident responders and deploying counter measures of their own. In 51% of the incidents that IR providers investigated last quarter, adversaries attempted to erase antivirus and security logs and block IR teams from critical forensic data. More than four in ten organizations that experienced a security incident last quarter reported finding a secondary command and control (C2) passageway on their network that was triggered to wakeup if the primary C2 was discovered.

"We are dealing with more of an insurgency within our infrastructure," Kellermann says. "The louder or more active we become with our countermeasures, the more punitive," attackers are likely to get.

The fact that a substantial proportion of destructive attacks emanated from groups within countries currently at odds with the US make it possible that at least some of them are geopolitically motivated, Kellermann adds. Groups within China and Russia, for instance, accounted for 47% of all cyberattacks that IR providers responded to last quarter.

Interestingly, more than two-thirds of incident responders believe that groups from these countries will attempt to influence the US midterm elections via cyberattacks.

For enterprises, the trend towards more destructive attacks highlights the need to pay attention to incident detection and response. Organizations that haven't already done so should conduct a threat-hunting exercise to find potentially compromised assets, Kellermann says. Optimally, such exercises need to be conducted on a regular basis.

Also important are endpoint threat assessments and penetration tests from outside the enterprise infrastructure, and inside as well to detect potential paths that attackers could take to get to other affiliate networks. Use of deception technologies and out-of-band communication methods can also be useful in helping enterprises hide their incident response activity and not tip their hand off to the attackers, he says.

Related Content:

 

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Where Businesses Waste Endpoint Security Budgets
Kelly Sheridan, Staff Editor, Dark Reading,  7/15/2019
How Attackers Infiltrate the Supply Chain & What to Do About It
Shay Nahari, Head of Red-Team Services at CyberArk,  7/16/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-7843
PUBLISHED: 2019-07-18
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Insufficient input validation vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user.
CVE-2019-7846
PUBLISHED: 2019-07-18
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Improper error handling vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user.
CVE-2019-7847
PUBLISHED: 2019-07-18
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Improper Restriction of XML External Entity Reference ('XXE') vulnerability. Successful exploitation could lead to Arbitrary read access to the file system in the context of the current user.
CVE-2019-7848
PUBLISHED: 2019-07-18
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Inadequate access control vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user.
CVE-2019-7850
PUBLISHED: 2019-07-18
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have a Command injection vulnerability. Successful exploitation could lead to Arbitrary Code Execution in the context of the current user.