Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

10/30/2018
05:30 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Destructive Cyberattacks Spiked in Q3

Instead of simply fleeing when discovered, adversaries are actively engaging with incident response teams, a new Carbon Black study finds.

New data gathered from more than three dozen providers of incident response services reveals a disturbing increase in the past quarter of destructive cyberattacks targeting US organizations.

What is not clear is whether the attacks—many of them from countries like China, Russia, and North Korea—are a response to the current geopolitical climate, or demonstrate increasingly punitive attempts by attackers to hide their tracks after being discovered.

Either way, the implications of the trend are serious for enterprises, says Tom Kellermann, chief security officer at Carbon Black, the security vendor behind the report. Between the second and third quarters of this year, there was a three-fold increase in destructive attacks where adversaries deleted or encrypted data, destroyed logs and backups, and caused system outages in ways designed to paralyze victims.

Thirty-two percent of the breaches that the 37 incident responders in Carbon Black's study investigated last quarter involved such attacks compared to 10% in the second quarter.

Compounding the severity of the situation was the fact that more than 50% of the attacks that the IR firms investigated involved so-called "island hopping," Kellermann says. These are attacks where threat actors target an organization so they can access an affiliate's network, like that belonging to a customer or partner. Thirty percent of victim organizations in the Carbon Black study saw their websites being turned into a watering hole by adversaries seeking to attack and associated company's network, he notes.

"Enterprises need to understand how their biggest customers and partners could be indirectly targeted either from or through their infrastructure," Kellerman says. "They need to do a better job of understanding East-West movement and do hunts and incident response in a more clandestine manner."

A lot of the data destruction and system disruption that incident responders encountered last quarter appears to be a manifestation of counter-incident response tactics by attackers.

Hackers Hacking IR

Instead of simply fleeing when discovered, many threat actors are instead actively engaging with incident responders and deploying counter measures of their own. In 51% of the incidents that IR providers investigated last quarter, adversaries attempted to erase antivirus and security logs and block IR teams from critical forensic data. More than four in ten organizations that experienced a security incident last quarter reported finding a secondary command and control (C2) passageway on their network that was triggered to wakeup if the primary C2 was discovered.

"We are dealing with more of an insurgency within our infrastructure," Kellermann says. "The louder or more active we become with our countermeasures, the more punitive," attackers are likely to get.

The fact that a substantial proportion of destructive attacks emanated from groups within countries currently at odds with the US make it possible that at least some of them are geopolitically motivated, Kellermann adds. Groups within China and Russia, for instance, accounted for 47% of all cyberattacks that IR providers responded to last quarter.

Interestingly, more than two-thirds of incident responders believe that groups from these countries will attempt to influence the US midterm elections via cyberattacks.

For enterprises, the trend towards more destructive attacks highlights the need to pay attention to incident detection and response. Organizations that haven't already done so should conduct a threat-hunting exercise to find potentially compromised assets, Kellermann says. Optimally, such exercises need to be conducted on a regular basis.

Also important are endpoint threat assessments and penetration tests from outside the enterprise infrastructure, and inside as well to detect potential paths that attackers could take to get to other affiliate networks. Use of deception technologies and out-of-band communication methods can also be useful in helping enterprises hide their incident response activity and not tip their hand off to the attackers, he says.

Related Content:

 

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
NSA Appoints Rob Joyce as Cyber Director
Dark Reading Staff 1/15/2021
Vulnerability Management Has a Data Problem
Tal Morgenstern, Co-Founder & Chief Product Officer, Vulcan Cyber,  1/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This is not what I meant by "I would like to share some desk space"
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-1303
PUBLISHED: 2021-01-20
A vulnerability in the user management roles of Cisco DNA Center could allow an authenticated, remote attacker to execute unauthorized commands on an affected device. The vulnerability is due to improper enforcement of actions for assigned user roles. An attacker could exploit this vulnerability by...
CVE-2021-1304
PUBLISHED: 2021-01-20
Multiple vulnerabilities in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization and modify the configuration of an affected system, gain access to sensitive information, and view information that they are not autho...
CVE-2021-1305
PUBLISHED: 2021-01-20
Multiple vulnerabilities in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization and modify the configuration of an affected system, gain access to sensitive information, and view information that they are not autho...
CVE-2021-1312
PUBLISHED: 2021-01-20
A vulnerability in the system resource management of Cisco Elastic Services Controller (ESC) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) to the health monitor API on an affected device. The vulnerability is due to inadequate provisioning of kernel parameters f...
CVE-2021-1349
PUBLISHED: 2021-01-20
A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct Cypher query language injection attacks on an affected system. The vulnerability is due to insufficient input validation by the web-based management interf...