NETSCOUT Threat Intelligence Report: Findings Summary 1st half of 2018

1. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. 1 NETSCOUT Threat Intelligence Report Powered by ATLAS Findings from First Half 2018 Richard Hummel Manager Intelligence Hardik Modi Sr Director Threat Intelligence

3. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. 3 NETSCOUT Threat Intelligence NETSCOUT Threat Intelligence ATLAS ASERT Advanced Threat Level Analysis System Arbor’s collective threat and traffic data depository that includes traffic stats from over one third of the Internet. Arbor’s unique correlation and analytics make it smart data ATLAS Security Engineering & Response Team NETSCOUT’s elite threat research organization that analyzes and curates ATLAS data to provide human and machine readable actionable intelligence to Arbor customers

4. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. 4 Threat Intelligence Mission Differentiation for NETSCOUT’s products and services Tactical and strategic intelligence for NETSCOUT’s customer base NETSCOUT’s thought leadership in security space

6. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. 6 The New NETSCOUT Threat Intelligence Report Summary of 1H 2018 Global DDoS attack data from ATLAS and threat campaign activity tracked by the ASERT research team. These two entities comprise NETSCOUT Threat Intelligence. Consolidated view of threat landscape and perspective of the team. Live on August 7th via press, printed at Black HAT WHEN: WHAT: WHY:

7. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. 7 The New NETSCOUT Threat Intelligence Report Extend credibility for NETSCOUT in the security space Demonstrate breadth of visibility and research through ATLAS and ASERT Prove coverage provided through AIF in NETSCOUT and Arbor products WHY:

8. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. 8 Key Findings An Accelerating Internet Scale Threat Paradigm • DDoS tactics being used for internal intrusions. Crimeware and espionage adding Internet Scale techniques (worms, botnets for mass malware distribution) • Big jump in frequency of very large DDoS attacks since Memcached. • Countries and verticals can be highly targeted. • More nation states adding APT to their statecraft. APT

9. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. 9 DDoS attacks enter the terabit era In Feb 2018, Memcached vulnerabilities drove the largest DDoS attacks seen to date Vulnerable systems remain available on the Internet continuing to drive large attacks

11. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. 11 APT groups expand beyond traditional arenas "Add cyber-attacks to their toolkit" • Campaigns and frameworks are discovered for a broad tier of nations OilRig (Iran) Fancy Bear (Russia) Hidden Cobra (North Korea) Ocean Lotus (Vietnam) Donot Team

12. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. 12 Crimeware actors diversify attack methods Emotet Trickbot Kardon Loader Panda Banker • Inspired by large-scale attacks in 2017, many known crimeware families have included auto- propagation (worm) techniques – Emotet – Trickbot – IcedID • There’s an increased focus on cryptocurrency mining • New platforms/affiliate programs like Kardon Loader continue to emerge • Banking trojans continually expand to new regions eg. Panda Banker in Japan

13. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. 13 New DDoS vectors & tools are rapidly leveraged ... • Memcached attacks went from non-existent to record-breaking in days • Botnets like Mirai incorporate new router exploits routinely

14. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. 14 … While old ones get new life "SSDP" • SImple Service Discovery Protocol (SSDP), in use since 2015, re-emerged in 2018 as a "new" method. • Netscout Threat Intelligence demonstrated the use of SSDP in 2015, proving this was not a new vecotor. • However, we uncovered a new class of SSDP abuse where vulnerable systems will respond to SSDP on non-standard ports, resulting in a flood of UDP packets with ephermeral source and destination ports. • Mitigation then becomes more difficult.

15. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. 15 Mirai Variants Emerge • Mirai was first used to launch high-profile, high-impact DDoS attacks in 2016 • Subsequently, source code was published • This has spawned a series of generations that introduce new functionality • ‘Satori’ leveraged remote code injections exploits for propagation • OMG introduced HTTP/SOCKS proxy • IoTrojan leveraged new router exploits "IoT Threats Rapidly Expand"

16. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. 16 APT campaigns can involve internet-scale footprints "Internet-scale & Supply Chain" • ‘Internet Scale’ factors in their approach too – NotPetya, WannaCry, BadRabbit are a few examples • Supply chain attacks are being seen more frequently (CCleaner) • Absolute Lojack recovery software for laptops is a representative finding • HiddenCobra (North Korea) uses DeltaCharlie malware to launch DDoS attacks from botnets.

17. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. 17 Top Targeted Verticals • Telecommunication Providers observe the overwhelming majority of attacks – inherent to their role • Shifts in popular targets relative to 2017 • ‘International Affairs’ in 7th spot • Represents first vertical analysis conducted on ATLAS data

NETSCOUT Threat Intelligence Report: Findings Summary 1st half of 2018

NETSCOUT Threat Intelligence Report: Findings Summary 1st half of 2018

Recomendados

Mais conteúdo relacionado

Mais procurados

Mais procurados(20)

Similar a NETSCOUT Threat Intelligence Report: Findings Summary 1st half of 2018

Similar a NETSCOUT Threat Intelligence Report: Findings Summary 1st half of 2018 (20)

Mais de NETSCOUT

Mais de NETSCOUT(11)

Último

Último(20)

NETSCOUT Threat Intelligence Report: Findings Summary 1st half of 2018