Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

10/1/2019
07:50 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Targeted Cybercrime On a Tear

CrowdStrike threat hunting data shows major increase in targeted financially motivated attacks in the first six months of 2019.

When it comes to targeted attacks, the volume of cybercrime campaigns actually overshadowed state-sponsored ones in the first half of this year. But that doesn't mean nation-state attacks declined.

New data published today from CrowdStrike's OverWatch threat-hunting service team shows that targeted cybercrime made up 61% of the targeted attacks CrowdStrike saw between January and June of 2019, a major spike from 2018, when it made up just 25% for the year. Nation-state attacks comprised 39% of the targeted attack campaigns in the first half of this year, versus 75% for all of last year.

"We saw an uptick in the second half of last year [with targeted cybercrime] as big game hunting was on the rise. And this year so far has lent itself to a major uptick," says Jennifer Ayers, vice president of OverWatch and security response at CrowdStrike. There were more targeted cybercrime attack campaigns in the first half of the year, and "an increase in hands-on keyboard activity," she says, as they burrowed through their victims' networks.

Part of the reason for the surge in targeted cybercrime was the well-documented rise in ransomware attacks going after commercial businesses and organizations in order to net bigger ransom fees, aka "big-game hunting." The attackers also have gotten more savvy about which critical servers to lock down in those attacks, ensuring bigger payouts. But the increase also had to do with cybercriminals doubling down on various types of data-stealing tools such as TrickBot, Ayers notes.

Overall, organizations report a surge in cyberattacks. A new global survey of CIOs, CTOs, and CISOs, by CrowdStrike rival Carbon Black shows that 84% of organizations have seen an increase in cyberattacks overall in the past 12 months, with 88% saying they suffered a data breach in that period. More than 80% report that attacks have gotten more advanced.

Nearly 45% suffered some financial damage from their breach, and 12% described the damage as "severe."

China, according to CrowdStrike's new data, remains the most prolific of nation-state players, a trend that CrowdStrike and other security research teams have seen for some time. OverWatch analysts spotted Chinese groups targeting the chemical, gaming, healthcare, hospitality, manufacturing, pharmaceutical, technology, and telecommunications industries in the first half of the year.

Telecommunications was one of the hottest targets for both state-sponsored hackers and cybercriminals. "Telecommunications is the new financial services" when it comes to being a big target, Ayers notes. "They are being hit really hard by multiple actors, but very interestingly, those actors all have different objectives."

While China's nation-state groups are after intellectual property as well as some telecom customer targets, cybercriminals are all about both stealing from telecom vendors for monetary gain but also using them as a stepping-stone to reach lucrative customer targets.

Meanwhile, the attackers are customizing legitimate IT tools such as CobaltStrike and Mimikatz, and employing tools like PC Hunter and Process Hacker to blend in and evade detection. They also are using legit tools to help them disable features of security tools in their targets' networks. "Security tools being targeted is not a new thing," Ayers notes, but since some newer-generation security tools are more difficult to disable, attackers are getting more aggressive in killing security tool processes and editing registries, or any other disruption to sneak past the tool.

What to Do About It

CrowdStrike recommends the usual security best practices for defense, including properly enabling the features in security tools such as machine learning and quarantining, and blocking known indicators of compromise. "Too often, due to uncertainty associated with potential false positives and business interruption, preventative features are left disabled or set in 'monitor' mode. As a result, attacks that could easily have been blocked get through," CrowdStrike said in its report today.

Behavioral analysis also can help catch nefarious activity that sneaks past traditional security controls, the company said.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Why Clouds Keep Leaking Data"

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing Writer,  11/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16860
PUBLISHED: 2019-11-19
Code42 app through version 7.0.2 for Windows has an Untrusted Search Path. In certain situations, a non-administrative attacker on the local machine could create or modify a dynamic-link library (DLL). The Code42 service could then load it at runtime, and potentially execute arbitrary code at an ele...
CVE-2019-16861
PUBLISHED: 2019-11-19
Code42 server through 7.0.2 for Windows has an Untrusted Search Path. In certain situations, a non-administrative attacker on the local server could create or modify a dynamic-link library (DLL). The Code42 service could then load it at runtime, and potentially execute arbitrary code at an elevated ...
CVE-2014-5118
PUBLISHED: 2019-11-18
A Security Bypass Vulnerability exists in TBOOT before 1.8.2 in the boot loader module when measuring commandline parameters.
CVE-2019-12422
PUBLISHED: 2019-11-18
Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.
CVE-2012-4441
PUBLISHED: 2019-11-18
Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML in the CI game plugin.