Natscout System, Inc, a provider of service assurance, security and business analytics, has released its latest Threat Landscape Report, offering globally scoped internet threat intelligence together with analysis from its security research arm.
Examining findings from the second half of 2018, the report covers the latest trends and activities including nation-state advanced persistent threat (APT) groups, IoT vulnerabilities, crimeware operations, and Distributed Denial of Service (DDoS) attack campaigns.
“Our global findings reveal that the threat landscape in the second half of 2018 represents the equivalent of attacks on steroids,” said Hardik Modi, Netscout’s senior director of Threat Intelligence. “With DDoS attack size and frequency, volume of nation state activity and speed of IoT threats all on the rise, the modern world can no longer ignore the digital threats we regularly face from malicious actors capable of capitalising on the interdependencies that wind through our pervasively connected world.”
Report highlights
By drawing on the internet-scale visibility of its Active Level Threat Analysis System (ATLAS) in conjunction with analysis from its ATLAS Security Engineering and Response Team (ASERT), Netscout Threat Intelligence provides a unique view into the threat landscape, demonstrated by a steady stream of discoveries during the second half of 2018.
During the course of the last six months, Netscout Threat Intelligence saw attackers bulk up existing tactics, rapidly evolve new performance enhancements, and apply smart business techniques to vastly accelerate attack growth rate. Key findings from the report include:
IoT’s countdown to attack
- Constant targets of DDoS malware, IoT devices come under attack within five minutes of being plugged in and targeted by specific exploits within 24 hours.
- IoT security is minimal to nonexistent on many devices, making this an increasingly dangerous and vulnerable sector, particularly as items ranging from medical devices to cars are IoT-equipped.
The ‘TerrorBit attack’ and beyond
- Overall, the number of DDoS attacks in 2018 was up 26% compared to the year previously, and attacks in the 100-400 Gbps range exploded, showing continued interest by bad actors in this attack vector and maturity of tooling in the mid-range of attacks.
- The global maximum DDoS attack size grew by 19% in the second half of 2018 versus the same period in the year previously, as threat actors launched strategic campaigns that compromised and used a vast array of devices related solely by internet connectivity. And “carpet bombing,” a new variant of the more common reflection or flooding DDoS attack, emerged, requiring different detection techniques.
Nation-state innovation
- DDoS attacks against the international affairs sector, which includes the United Nations, the International Monetary Fund and the State Department, increased by nearly 200% between 2H 2017 and 2H 2018
- The volume of nation state APT group activity has increased in the space of the last year, as have the number of targets. Subsequently, Netscout is now monitoring the activities of at least 35 groups across several countries, which include Iran, China, Russia, and North Korea.
- These groups are employing new techniques, combining custom-made tools with commodity crimeware as in the case of STOLEN PENCIL to extend their reach and impact.
Commercialisation of crimeware
- The cybercriminal underground operates much like legitimate businesses using the conventional business practice of the affiliate model to rapidly generate profits. Increases in attack size reflect the continued monetisation of the threat landscape.
- Campaigns like DanaBot increased distribution efficiency and cut labor costs by using an affiliate model to rapidly establish its presence across the globe, with 12 separate affiliates targeting financial institutions in many countries.
- However, collaborative crime fighting is also on the rise, illustrated by recent efforts with the ASERT team and the Federal Bureau of Investigation (FBI) during an investigation into MedusaHTTP DDoS, a botnet from a hacker known as stevenkings, that ultimately led to charges being filed.
Through telemetry on a massive scale, ATLAS delivers visibility into the backbone networks at the core of the internet. Netscout gathers data shared by organisations around the world, including 90% of Tier 1 service providers, representing approximately one third of internet traffic.
Netscout correlates this and other data sets to provide automated data sharing and intelligence, facilitating usage by all internet users, business and private, and giving them a broader perspective to better understand and react to the threats they face.
Comment on this article below or via Twitter: @IoTNow_OR @jcIoTnow
