Targeted Cybercrime On a Tear

When it comes to targeted attacks, the volume of cybercrime campaigns actually overshadowed state-sponsored ones in the first half of this year. But that doesn't mean nation-state attacks declined.

New data published today from CrowdStrike's OverWatch threat-hunting service team shows that targeted cybercrime made up 61% of the targeted attacks CrowdStrike saw between January and June of 2019, a major spike from 2018, when it made up just 25% for the year. Nation-state attacks comprised 39% of the targeted attack campaigns in the first half of this year, versus 75% for all of last year.

"We saw an uptick in the second half of last year [with targeted cybercrime] as big game hunting was on the rise. And this year so far has lent itself to a major uptick," says Jennifer Ayers, vice president of OverWatch and security response at CrowdStrike. There were more targeted cybercrime attack campaigns in the first half of the year, and "an increase in hands-on keyboard activity," she says, as they burrowed through their victims' networks.

Part of the reason for the surge in targeted cybercrime was the well-documented rise in ransomware attacks going after commercial businesses and organizations in order to net bigger ransom fees, aka "big-game hunting." The attackers also have gotten more savvy about which critical servers to lock down in those attacks, ensuring bigger payouts. But the increase also had to do with cybercriminals doubling down on various types of data-stealing tools such as TrickBot, Ayers notes.

Overall, organizations report a surge in cyberattacks. A new global survey of CIOs, CTOs, and CISOs, by CrowdStrike rival Carbon Black shows that 84% of organizations have seen an increase in cyberattacks overall in the past 12 months, with 88% saying they suffered a data breach in that period. More than 80% report that attacks have gotten more advanced.

Nearly 45% suffered some financial damage from their breach, and 12% described the damage as "severe."

China, according to CrowdStrike's new data, remains the most prolific of nation-state players, a trend that CrowdStrike and other security research teams have seen for some time. OverWatch analysts spotted Chinese groups targeting the chemical, gaming, healthcare, hospitality, manufacturing, pharmaceutical, technology, and telecommunications industries in the first half of the year.

Telecommunications was one of the hottest targets for both state-sponsored hackers and cybercriminals. "Telecommunications is the new financial services" when it comes to being a big target, Ayers notes. "They are being hit really hard by multiple actors, but very interestingly, those actors all have different objectives."

While China's nation-state groups are after intellectual property as well as some telecom customer targets, cybercriminals are all about both stealing from telecom vendors for monetary gain but also using them as a stepping-stone to reach lucrative customer targets.

Meanwhile, the attackers are customizing legitimate IT tools such as CobaltStrike and Mimikatz, and employing tools like PC Hunter and Process Hacker to blend in and evade detection. They also are using legit tools to help them disable features of security tools in their targets' networks. "Security tools being targeted is not a new thing," Ayers notes, but since some newer-generation security tools are more difficult to disable, attackers are getting more aggressive in killing security tool processes and editing registries, or any other disruption to sneak past the tool.

What to Do About It

CrowdStrike recommends the usual security best practices for defense, including properly enabling the features in security tools such as machine learning and quarantining, and blocking known indicators of compromise. "Too often, due to uncertainty associated with potential false positives and business interruption, preventative features are left disabled or set in 'monitor' mode. As a result, attacks that could easily have been blocked get through," CrowdStrike said in its report today.

Behavioral analysis also can help catch nefarious activity that sneaks past traditional security controls, the company said.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Why Clouds Keep Leaking Data"