Fortinet® (NASDAQ: FTNT), a global leader in broad, integrated, and automated cybersecurity solutions, has announced the findings of its latest quarterly Global Threat Landscape Report. The research reveals that cybercriminals continue to evolve the sophistication of their attack methods, from tailored ransomware and custom coding for some attacks, to living-off-the-land (LoTL) or sharing infrastructure to maximize their opportunities. Highlights of the report follow:

 

Pre- and Post-Compromise Traffic: Research to see if threat actors carry out phases of their attacks on different days of the week demonstrates that cybercriminals are always looking to maximize opportunity to their benefit. When comparing Web filtering volume for two cyber kill chain phases during weekdays and weekends, pre-compromise activity is roughly three times more likely to occur during the work week, while post-compromise traffic shows less differentiation in that regard. This is primarily because exploitation activity often requires someone to take an action such as clicking on a phishing email. In contrast, command-and-control (C2) activity does not have this requirement and can occur anytime. Cybercriminals understand this and will work to maximize opportunity during the week when Internet activity is the most prevalent. Differentiating between weekday and weekend Web filtering practices is important to fully understand the kill chain of various attacks.

 

Majority of Threats Share Infrastructure: The degree to which different threats share infrastructure shows some valuable trends. Some threats leverage community-use infrastructure to a greater degree than unique or dedicated infrastructure. Nearly 60% of threats shared at least one domain indicating the majority of botnets leverage established infrastructure. IcedID is an example of this “why buy or build when you can borrow” behavior. In addition, when threats share infrastructure they tend to do so within the same stage in the kill chain. It is unusual for a threat to leverage a domain for exploitation and then later leverage it for C2 traffic. This suggests infrastructure plays a particular role or function when used for malicious campaigns. Understanding what threats share infrastructure and at what points of the attack chain enables organizations to predict potential evolutionary points for malware or botnets in the future.

 

 

Content Management Needs Constant Management: Adversaries tend to move from one opportunity to the next in clusters, targeting successfully exploited vulnerabilities and technologies that are on the upswing, to quickly maximize opportunity. An example of new technologies getting a lot of attention from cybercriminals recently are Web platforms that make it easier for consumers and businesses to build Web presences. They continue to be targeted, even associated third party plugins. This reinforces the fact that it is critical that patches be applied immediately and to fully understand the constantly evolving world of exploits to stay ahead of the curve.

 

Ransomware Far from Gone: In general, previous high rates of ransomware have been replaced with more targeted attacks, but ransomware is far from gone. Instead, multiple attacks demonstrate it is being customized for high-value targets and to give the attacker privileged access to the network. LockerGoga is an example of a targeted ransomware conducted in a multi-stage attack. There is little about LockerGoga that sets it apart from other ransomware in terms of functional sophistication, but while most ransomware tools use some level of obfuscation to avoid detection, there was little of it used when analyzed. This suggests the targeted nature of the attack and a predetermination that the malware would not be easily detected. In addition, like most other ransomware, the main goal of Anatova is to encrypt as many files as possible on the victim system, except that it systematically avoids encrypting anything that can impact the stability of the system it is infecting. It also avoids infecting computers that look like they are being used for malware analysis or as honeypots. Both of these ransomware variants demonstrate that security leaders need to remain focused on patching and backups against commodity ransomware, but targeted threats require more tailored defenses to protect against their unique attack methods.

 

Tools and Tricks for Living Off the Land: Because threat actors operate using the same business models as their victims, to maximize their efforts, attack methods often continue to develop even after gaining an initial entry. To accomplish this, threat actors increasingly leverage dual-use tools or tools that are already pre-installed on targeted systems to carry out cyberattacks. This “living off the land” (LoTL) tactic allows hackers to hide their activities in legitimate processes and makes it harder for defenders to detect them. These tools also make attack attribution much harder. Unfortunately, adversaries can use a wide range of legitimate tools to accomplish their goals and hide in plain sight. Smart defenders will need to limit access to sanctioned administrative tools and log use in their environments.

 

 

The Need for Dynamic and Proactive Threat Intelligence
Improving an organization’s ability to not only properly defend against current threat trends, but also prepare for the evolution and automation of attacks over time requires threat intelligence that is dynamic, proactive, and available throughout the distributed network. This knowledge can help identify trends showing the evolution of attack methods targeting the digital attack surface and to pinpoint cyber hygiene priorities based on where bad actors are focusing their efforts. The value and ability to take action on threat intelligence is severely diminished if it cannot be actionable in real time across each security device. Only a security fabric that is broad, integrated, and automated can provide protection for the entire networked environment, from IoT to the edge, network core and to multi-clouds at speed and scale.

 

“We, unfortunately, continue to see the cybercriminal community mirror the strategies and methodologies of nation-state actors, and the evolving devices and networks they are targeting. Organizations need to rethink their strategy to better future proof and manage cyber risks. An important first step involves treating cybersecurity more like a science – doing the fundamentals really well – which requires leveraging the cyberspace fundamentals of speed and connectivity for defense. Embracing a fabric approach to security, micro and macro segmentation, and leveraging machine learning and automation as the building blocks of AI, can provide tremendous opportunity to force our adversaries back to square one.” – Phil Quade, Chief Information Security Officer, Fortinet.

 

Report and Index Overview
The latest Fortinet Threat Landscape Report is a quarterly view that represents the collective intelligence of FortiGuard Labs, drawn from Fortinet’s vast array of global sensors during Q1 2019. Research data covers global and regional perspectives. Also included in the report is the Fortinet Threat Landscape Index (TLI), comprised of individual indices for three central and complementary aspects of that landscape which are exploits, malware, and botnets, showing prevalence and volume in a given quarter.

 


RECOMMENDED ARTICLE FOR TECHWORLD


 
Simplify Your Life with the USB Type-C Storage Solutions from Transcend
Techworld Date Posted: 10 May 2019 11:26 AM | 77 Views
With the growing adoption of the USB Type-C standard by new platforms and devices, Transcend Information, Inc. (Transcend), a leading manufacturer of storage and multimedia products, has constantly developed a wide range of USB.... See More
 
Simplify Your Life with the USB Type-C Storage Solutions from Transcend
Techworld Date Posted: 11:26 AM | 77 Views
With the growing adoption of the USB Type-C standard by new platforms and devices, Transcend Information, Inc. (Transcend), a leading manufacturer of storage and multimedia products, has constantly developed a wide range of USB...See More

 
5 Entertaining Vlogs to Help Get You through Everyday Traffic
Techworld Date Posted: 31 May 2018 2:52 PM | 381 Views
We have come to accept traffic as part of city life, and we all have our ways of coping like sneaking in a quick nap, tuning into our own ‘traffic playlist,’ catching up on.... See More
 
5 Entertaining Vlogs to Help Get You through Everyday Traffic
Techworld Date Posted: 2:52 PM | 381 Views
We have come to accept traffic as part of city life, and we all have our ways of coping like sneaking in a quick nap, tuning into our own ‘traffic playlist,’ catching up on...See More

 
5 out of 10 Filipino Internet Users Affected by Cybersecurity Incidents in H2 2016
Techworld Date Posted: 26 July 2017 2:49 PM | 402 Views
More than half of the internet users in the Philippines have been hacked or infected with malware during the last six months of 2016, according to the Kaspersky Cybersecurity Index. Almost the same number.... See More
 
5 out of 10 Filipino Internet Users Affected by Cybersecurity Incidents in H2 2016
Techworld Date Posted: 2:49 PM | 402 Views
More than half of the internet users in the Philippines have been hacked or infected with malware during the last six months of 2016, according to the Kaspersky Cybersecurity Index. Almost the same number...See More

 
New Forces Join Popular Team Group Gaming T-FORCE Series
Techworld Date Posted: 30 September 2017 9:35 AM | 89 Views
Team Group, world renowned memory solutions and accessory provider, is proud to announce today the addition of new products as to their prestigious T-FORCE gaming line of products. See More
 
New Forces Join Popular Team Group Gaming T-FORCE Series
Techworld Date Posted: 9:35 AM | 89 Views
Team Group, world renowned memory solutions and accessory provider, is proud to announce today the addition of new products as to their prestigious T-FORCE gaming line of productsSee More

 
Samsung Galaxy S10 Is Now Available with Smart Signature Plans
Techworld Date Posted: 29 July 2019 6:00 PM | 242 Views
Samsung Galaxy S10 Is Now Available with Smart Signature Plans. See More
 
Samsung Galaxy S10 Is Now Available with Smart Signature Plans
Techworld Date Posted: 6:00 PM | 242 Views
Samsung Galaxy S10 Is Now Available with Smart Signature PlansSee More

 
New Version of Kaspersky Password Manager Helps to Keep Valuable Digital Data in Order
Techworld Date Posted: 23 March 2019 10:11 AM | 68 Views
Kaspersky Lab has released a new version of its freemium solution: Kaspersky Password Manager. The solution further simplifies the process of organizing valuable private data – from passwords to documents and photographs. Kaspersky Password.... See More
 
New Version of Kaspersky Password Manager Helps to Keep Valuable Digital Data in Order
Techworld Date Posted: 10:11 AM | 68 Views
Kaspersky Lab has released a new version of its freemium solution: Kaspersky Password Manager. The solution further simplifies the process of organizing valuable private data – from passwords to documents and photographs. Kaspersky Password...See More

 
Nokia 5.1 Plus Takes a Sweet Taste of Android™ 9 Pie at the Start of the Year
Techworld Date Posted: 8 January 2019 1:50 PM | 65 Views
HMD Global, the home of Nokia phones, has announced that Filipino Nokia fans can now enjoy the latest Android operating system, Android 9 Pie on their Nokia 5.1 Plus. . See More
 
Nokia 5.1 Plus Takes a Sweet Taste of Android™ 9 Pie at the Start of the Year
Techworld Date Posted: 1:50 PM | 65 Views
HMD Global, the home of Nokia phones, has announced that Filipino Nokia fans can now enjoy the latest Android operating system, Android 9 Pie on their Nokia 5.1 Plus. See More

 
DevCon Summit 2019 to Elevate the I.T. Industry
Techworld Date Posted: 11 June 2019 5:10 PM | 157 Views
The DevCon Summit is an annual event that aims to uplift the I.T. industry in the country. To celebrate its 10th year anniversary this 2019, the summit will be held at the SM Aura.... See More
 
DevCon Summit 2019 to Elevate the I.T. Industry
Techworld Date Posted: 5:10 PM | 157 Views
The DevCon Summit is an annual event that aims to uplift the I.T. industry in the country. To celebrate its 10th year anniversary this 2019, the summit will be held at the SM Aura...See More

 
Geopolitics and South East Asian Targets Power Threat Activity in Q1 as the Big Players Stay Quiet
Techworld Date Posted: 10 May 2019 2:18 PM | 67 Views
In the first three months of 2019, Kaspersky Lab researchers observed an active landscape of advanced threat operations that was centered mainly on South East Asia, increasingly influenced by geopolitics, which featured cryptocurrency and.... See More
 
Geopolitics and South East Asian Targets Power Threat Activity in Q1 as the Big Players Stay Quiet
Techworld Date Posted: 2:18 PM | 67 Views
In the first three months of 2019, Kaspersky Lab researchers observed an active landscape of advanced threat operations that was centered mainly on South East Asia, increasingly influenced by geopolitics, which featured cryptocurrency and...See More

 
Q3 2017 Akamai State of the Internet / Security Report Reveals Significant Increase in Web Application Security Attacks, Evolution of Attacker Strategies
Techworld Date Posted: 1 December 2017 3:40 PM | 426 Views
Newly released data shows that web application attacks continued to rise significantly in both the quarter-over-quarter and year-over-year timeframes, according to the Third Quarter, 2017 State of the Internet / Security Report released by.... See More
 
Q3 2017 Akamai State of the Internet / Security Report Reveals Significant Increase in Web Application Security Attacks, Evolution of Attacker Strategies
Techworld Date Posted: 3:40 PM | 426 Views
Newly released data shows that web application attacks continued to rise significantly in both the quarter-over-quarter and year-over-year timeframes, according to the Third Quarter, 2017 State of the Internet / Security Report released by...See More


Power by

Download Free AZ | Free Wordpress Themes