Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

10/1/2019
07:50 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Targeted Cybercrime On a Tear

CrowdStrike threat hunting data shows major increase in targeted financially motivated attacks in the first six months of 2019.

When it comes to targeted attacks, the volume of cybercrime campaigns actually overshadowed state-sponsored ones in the first half of this year. But that doesn't mean nation-state attacks declined.

New data published today from CrowdStrike's OverWatch threat-hunting service team shows that targeted cybercrime made up 61% of the targeted attacks CrowdStrike saw between January and June of 2019, a major spike from 2018, when it made up just 25% for the year. Nation-state attacks comprised 39% of the targeted attack campaigns in the first half of this year, versus 75% for all of last year.

"We saw an uptick in the second half of last year [with targeted cybercrime] as big game hunting was on the rise. And this year so far has lent itself to a major uptick," says Jennifer Ayers, vice president of OverWatch and security response at CrowdStrike. There were more targeted cybercrime attack campaigns in the first half of the year, and "an increase in hands-on keyboard activity," she says, as they burrowed through their victims' networks.

Part of the reason for the surge in targeted cybercrime was the well-documented rise in ransomware attacks going after commercial businesses and organizations in order to net bigger ransom fees, aka "big-game hunting." The attackers also have gotten more savvy about which critical servers to lock down in those attacks, ensuring bigger payouts. But the increase also had to do with cybercriminals doubling down on various types of data-stealing tools such as TrickBot, Ayers notes.

Overall, organizations report a surge in cyberattacks. A new global survey of CIOs, CTOs, and CISOs, by CrowdStrike rival Carbon Black shows that 84% of organizations have seen an increase in cyberattacks overall in the past 12 months, with 88% saying they suffered a data breach in that period. More than 80% report that attacks have gotten more advanced.

Nearly 45% suffered some financial damage from their breach, and 12% described the damage as "severe."

China, according to CrowdStrike's new data, remains the most prolific of nation-state players, a trend that CrowdStrike and other security research teams have seen for some time. OverWatch analysts spotted Chinese groups targeting the chemical, gaming, healthcare, hospitality, manufacturing, pharmaceutical, technology, and telecommunications industries in the first half of the year.

Telecommunications was one of the hottest targets for both state-sponsored hackers and cybercriminals. "Telecommunications is the new financial services" when it comes to being a big target, Ayers notes. "They are being hit really hard by multiple actors, but very interestingly, those actors all have different objectives."

While China's nation-state groups are after intellectual property as well as some telecom customer targets, cybercriminals are all about both stealing from telecom vendors for monetary gain but also using them as a stepping-stone to reach lucrative customer targets.

Meanwhile, the attackers are customizing legitimate IT tools such as CobaltStrike and Mimikatz, and employing tools like PC Hunter and Process Hacker to blend in and evade detection. They also are using legit tools to help them disable features of security tools in their targets' networks. "Security tools being targeted is not a new thing," Ayers notes, but since some newer-generation security tools are more difficult to disable, attackers are getting more aggressive in killing security tool processes and editing registries, or any other disruption to sneak past the tool.

What to Do About It

CrowdStrike recommends the usual security best practices for defense, including properly enabling the features in security tools such as machine learning and quarantining, and blocking known indicators of compromise. "Too often, due to uncertainty associated with potential false positives and business interruption, preventative features are left disabled or set in 'monitor' mode. As a result, attacks that could easily have been blocked get through," CrowdStrike said in its report today.

Behavioral analysis also can help catch nefarious activity that sneaks past traditional security controls, the company said.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Why Clouds Keep Leaking Data"

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/14/2020
Lock-Pickers Face an Uncertain Future Online
Seth Rosenblatt, Contributing Writer,  8/10/2020
Hacking It as a CISO: Advice for Security Leadership
Kelly Sheridan, Staff Editor, Dark Reading,  8/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 New Cybersecurity Vulnerabilities That Could Put Your Enterprise at Risk
In this Dark Reading Tech Digest, we look at the ways security researchers and ethical hackers find critical vulnerabilities and offer insights into how you can fix them before attackers can exploit them.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-17475
PUBLISHED: 2020-08-14
Lack of authentication in the network relays used in MEGVII Koala 2.9.1-c3s allows attackers to grant physical access to anyone by sending packet data to UDP port 5000.
CVE-2020-0255
PUBLISHED: 2020-08-14
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-10751. Reason: This candidate is a duplicate of CVE-2020-10751. Notes: All CVE users should reference CVE-2020-10751 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidenta...
CVE-2020-14353
PUBLISHED: 2020-08-14
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-18270. Reason: This candidate is a duplicate of CVE-2017-18270. Notes: All CVE users should reference CVE-2017-18270 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidenta...
CVE-2020-17464
PUBLISHED: 2020-08-14
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE-2020-17473
PUBLISHED: 2020-08-14
Lack of mutual authentication in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.0_20190723 allows an attacker to obtain a long-lasting token by impersonating the server.