DOCSLIB.ORG

2021 Sonicwall Cyber Threat Report

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
2021 Sonicwall Cyber Threat Report 2 0 SONICWALL 2 1 SİBER TEHDİT RAPORU İş dünyasının yeni gerçeklerine içeriden bakan siber tehdit istihbaratı sonicwall.com | @sonicwall 2021-SonicWall-Cyber-Threat-Report.indd 1 19.04.2021 09:38:08 İçindekiler Bill’den Bir Mesaj 3 Bölgeler Bazında Fidye Yazılımları 37 Giriş 4 Fidye Yazılımı İmzaları 38 2020 Global Siber Atak Trendleri 5 Sektörel Bazda Fidye Yazılımları 42 2020’nin En Büyük Veri İhlalleri 6 İzinsiz Giriş Denemeleri 44 Siber Güvenliğin Geleceğini Değiştiren Güç Kayması 7 En Önemli İzinsiz Giriş Atakları 46 2015'ten Bu Yana Yayımlanan CVE'ler Neredeyse Üçe Katlandı 10 Bölgeler Bazında İzinsiz Giriş Denemeleri 47 2020’de En Çok Kullanılan 8 CVE 10 Capture ATP ve RTDMI 48 2020 Sıfır-Gün Güvenlik Açıkları 12 ‘Daha Önce Hiç Görülmemiş’ Malware 50 COVID Tehditleri: Pandeminin Kötüye Kullanılması 13 Kötü Niyetli Office ve PDF Dosyaları 51 Sektörler Bazında COVID-19 ile İlgili Ataklar 14 Cryptojacking 52 2020’nin En Büyük Siber Güvenlik Olayları 16 Sektörel Bazda Cryptojacking Atakları 56 2020 Yılına Ait Önemli Bulgular 19 IoT Malware Atakları 58 Malware Atak Girişimleri 21 IoT Malware Atakları ile Bir Yıl 62 Malware Yaygınlığı 22 Sektörler Bazında IoT Malware Atakları 64 Ülkeler Bazında Malware Riski 24 Standart Dışı Port’lar 66 Ülkeler Bazında Malware Yaygınlığı 30 Son Söz 67 Sektörel Bazda Malware Atakları 31 SonicWall Capture Labs Threat Network Hakkında 68 Şifreli Ataklar 33 Yetkin Tehdit Araştırmacıları 69 Fidye Yazılımları 35 SonicWall Hakkında 70 2 | 2021 SonicWall Siber Tehdit Raporu Bill’den bir mesaj Dünya Ekonomik Forumu, yakın zamanda yapılan bir Siber dayanıklılık, ağ ve verilerinizi korumanın ötesinde, bir araştırmada katılımcılara önümüzdeki iki yıl boyunca dünya atak veya öngörülemeyen başka bir olay durumunda iş için hangi tehlikelerin en büyük tehditleri oluşturacağını sordu. sürekliliğinin sağlanmasına odaklanmayı gerektiriyor. Pandemi yılında beklenebileceği üzere, “bulaşıcı hastalıklar” İster enerji santralleri, kamu kurumları, emniyet teşkilatı veya ve “geçim krizleri” listenin başında yer aldı. Ancak ilk dördü hayati bir ihtiyacı karşılayan başka bir grup olsun, yüksek riskli tamamlayanlar, “şiddetli hava olayları” ve “siber güvenlik ortamlardaki hemen her kuruluşun bir dayanıklılık felsefesi başarısızlıkları” oldu. bulunur. Bu, bir acil durum planı veya bir geri çekilme planı Bu son endişelerin tahmin edilenden daha fazla ortak yanı var, olabilir ya da bir kod adı ile anılabilir, ancak ana fikir aynıdır: hele de günümüzde. İşin aslı, 2020’de yaşanan siber güvenlik İşler beklendiği gibi gitmediği zaman operasyonların nasıl sorunları, belirli oranda şiddetli bir hava olayı kadar etkili oldu: yürütüleceğini anlatırlar. Aniden geldiler, birçok kişiyi hazırlıksız yakaladılar, ciddi Ve çok az şeyin beklendiği gibi gittiği 2020 yılı, siber hasarlar verdiler; hatta bazı işletmeler halen enkaz temizleme dayanıklılık konusuna yalnızca bir ‘en iyi uygulama’ gözüyle çalışmaları yapıyor. bakmanın ne kadar tehlikeli olduğunu gösterdi. “Bir atağı nasıl Tarih, pandeminin getirdiği hala anlatılmamış sosyal, önleriz?” yaklaşımımızı “Atağa uğradığımızda (uğrarsak değil) ekonomik ve politik değişikliklerin yanı sıra siber güvenlikte ne yapacağız?” sorusu ile genişletmemiz çok önemli. de büyük bir değişikliğe de tanık oldu. COVID-19 tüm Yalnızca 2021 SonicWall Siber Tehdit Raporunda dünyaya yayılırken, bu durumu benzeri görülmemiş bir siber bulabileceğiniz tehdit istihbaratını incelemenizi öneririz. Bu en suç dalgası izledi ve neredeyse her türden siber saldırı yeni siber tehdit verileri, siber suçluların büyük ölçüde yön oranlarını artırdı (bazen çok fazla yükseltti.) değiştiren bir dünyada taktiklerini nasıl değiştirip Bu konu, tüm zamanların en büyük ve en kapsamlı siber geliştirdiklerine bir bakış ve önlerinde uzanan belirsiz dünyanın saldırılarından biri olarak kabul edilen yazılım şirketi ortasında neler yapabileceklerine dair bir fikir sunuyor… SolarWinds'in aralık ayında başarılı bir şekilde ihlal edilmesiyle zirveye ulaştı. (SolarWinds olayı hakkında daha fazla bilgi için sayfa 7'yi okuyun.) BILL CONNER Bu olay, başta siber dayanıklılığın önemi olmak üzere bazı BAŞKAN & CEO SONICWALL dersler de getirdi. 3 | 2021 SonicWall Siber Tehdit Raporu | Bill'den bir mesaj GİRİŞ Siber Suçluların Mükemmel Fırtınası Siber suçlular her zaman fırsatları kollamışlardır; 2020 her ölçekteki tehdit aktörlerinin genellikle de en sofistike COVID-19 pandemisi bu durumu, belki de daha önce ulusal kampanyalara yönelik olarak ağır hasarlar vermesine hiç olmadığı kadar net biçimde ortaya koydu. olanak tanıdı. Ve birçoğu, bu mükemmel fırtınayı bilinmeyen Tehdit aktörleri daha güçlü ve daha saldırgan hale gelirken zenginliklere doğru sürerken, maruz kalanlar, yıkımla sayıca da artıyorlar ve en büyük madenlere ulaşma yüzleştiler. eğiliminden uzaklaşarak en savunmasız olana saldırmayı 2020 yılında SonicWall Capture Labs tehdit araştırmacıları, 5,6 tercih ediyorlar. milyar kötü amaçlı yazılım atağı kaydetti – bu rakam, önceki Ve 2020, savunmasız hedeflerle doluydu. yıla göre keskin bir düşüş. Ancak bu durum, bir kutlama nedeni Milyonlarca güçlü ve çoğu, böylesine bir güç değişiminin olamaz. Birçok kişinin evden çalışmaya başlaması ile birlikte getirdiği güvenlik sonuçlarından ya da en iyi uygulamalardan siber güvenlik tedarikçileri, trafik ve beraberindeki potansiyel haberi olmayan yeni bir uzaktan çalışan sınıfından… atakları izleyebilme olanaklarını giderek kaybediyor. Yani bu sayı çok daha yüksek olabilir. … COVID-19 hakkında daha fazla bilgi sunduğunu iddia eden her şeye güvenmeye istekli kişilerin de bulunduğu, paniklemiş Daha da kötüsü, hemen her yerde, siber suç sayılarının birkaç ve kafası karışmış bir kitleye … durumda yeni rekorlar kırdığını gördük. … kapasitesini aşan ve fazla çalışan hastanelere … Siber suçların mükemmel fırtınasının 2021'e de uzayıp uzamayacağı belirsiz olsa da geçtiğimiz yıl geçerli olan … siber suçlular kendilerini mükemmel bir fırsat fırtınasının unsurların bir araya gelmesinin siber suçları yeni bir seviyeye ortasında buldular. Bulut düzeyinde altyapı kombinasyonları; taşıdığı, yeni yıla girerken daha fazla güvenlik, ihtiyat ve PowerShell, Mimikatz ve Cobalt Strike gibi atak araçlarının kurnazlık gerektirdiği şimdiden görülüyor. yaygın olarak erişilebilirliği ve anonim kripto para ödemeleri, 4 | 2021 SonicWall Siber Tehdit Raporu | Giriş 2020 Global Siber Atak Trendleri 5.6 Milyar 3.8 Milyon 4.8 Trilyon 81.9 Milyon 304.6 Milyon 56.9 Milyon MALWARE ŞİFRELİ İHLAL CRYPTOJACKING FİDYE YAZILIMI IoT ATAĞI TEHDİT GİRİŞİMİ ATAĞI ATAĞI ATAĞI -43% +4% +20% +28% +62% +66% Yıllık Değişim, 2019-2020 En iyi uygulama olarak SonicWall, veri toplama, analiz ve raporlama için metodolojilerini rutin olarak optimize ediyor. Buna veri temizlemeye yönelik iyileştirmeler, veri kaynaklarındaki değişiklikler ve tehdit akışlarının birleştirilmesi de dahildir. Önceki raporlarda yayımlanan rakamlar farklı zaman dilimleri, bölge veya sektörlere göre ayarlanmış olabilir. 5 | 2021 SonicWall Siber Tehdit Raporu | 2020 Global Siber Atak Trendleri 2020’nin En Büyük Veri İhlalleri Bu yılın Siber Tehdit Raporunda parlak noktaların fazla Ancak maalesef bu listenin bir zaferi temsil ettiğini bulunmadığını belirtmiştik ve bu konu da onlardan biri. söylemek yanlış olur. Bu listedeki son iki giriş, açığa çıkan 2020’de gerçekleşen en büyük ihlal 440 milyon kaydı kayıtların sayısı bakımından küçük olsa da bu ihlallerin etkiledi ki bu rakam 2019’un en büyük ihlali ile etkilenen 2 dalgaları, büyük çokuluslu şirketler ve federal milyar kaydın çeyreği kadar bile değil. hükümetleri temelinden sarstı ve etkileri yıllarca, hatta on yıllarca hissedilebilir. En Büyük Veri İhlalleri İSİM ENDÜSTRİ RAPOR TARİHİ KAYIT SAYISI Estée Lauder Cilt Bakımı 1/30/20 440 milyon Microsoft Yazılım 1/22/20 280 milyon Facebook Sosyal Ağ 4/1/20 267 milyon MGM Grand Hotels Konaklama 7/14/20 142 milyon Pakistan mobil kullanıcılar Telecommunication 5/6/20 44 milyon Wishbone Sosyal Ağ 5/20/20 40 milyon Vetrafore Yazılım 11/13/20 27.7 milyon Unacademy Eğitim 5/7/20 22 milyon Bigbasket Online Market 10/30/20 20 milyon Couchsurfing Sosyal Ağ 7/23/20 17 milyonon Home Chef Yemek Siparişi 5/22/20 8 milyon Marriott International Konaklama 3/31/20 5.2 milyon Dunzo Delivery Services 7/29/20 3.4 milyon Edureka Eğitim 9/30/20 2 milyon Danimarka Hükumeti Vergi Portalı Dağıtım ve Kurye Hizmetleri 2/10/20 1.26 milyon Zoom Yazılım 4/14/20 500,000 Magellan Health Sağlık 5/13/20 365,000 WhiteHat Jr Eğitim 11/25/20 280,000 Defense Information Systems Agency Askeri Destekler 2/24/20 200,000 (DISA) Nintendo Tüketici Elektroniği 4/24/20 160,000 U.S. Department of Veterans Affairs Kamu Hizmetleri 9/15/20 46,000 NHS, Wales Sağlık 9/15/20 18,105 SolarWinds BT Yönetim Yazılımları 12/13/20 18,000 FireEye Siber Güvenlik 12/8/20 Red Team Araçları 6 | 2021 SonicWall Siber Tehdit Raporu | 2020’nin En Büyük Veri İhlalleri Siber Güvenliğin Geleceğini Değiştiren Güç Kayması Küresel COVID-19 salgınının doruk noktasında, tehdit SUNBURST olarak adlandırılan truva atı ailesi, Orion'un meşru ortamı, siber güvenliği sonsuza dek değiştirecek kritik bir bir bileşeni gibi gizlendi ve tespit edilmemek için büyük çaba tepe noktasına ulaştı. Yeni evden çalışma gerçekliği, sarf etti. Truva atı daha sonra çoğunlukla Amerikan katlanarak büyüyen saldırı yüzeyleri oluştururken bilinmeyen şirketlerinde ve hükümet ağlarında büyük bir casusluk ve veri sayıda yeni vektör ve sonsuz zafiyet noktaları ortaya çıkardı. hırsızlığı operasyonu yürütmek için kullanıldı. Bulut ölçeğindeki altyapılar ve yaygın olarak erişilebilen
Load more

Recommended publications
  • CYBER ATTACK TRENDS Mid Year Report 2021 CONTENTS
    CYBER ATTACK TRENDS Mid Year Report 2021 CONTENTS 04 EXECUTIVE SUMMARY 07 TRIPLE EXTORTION RANSOMWARE—THE THIRD-PARTY THREAT 11 SOLARWINDS AND WILDFIRES 15 THE FALL OF AN EMPIRE—EMOTET’S FALL AND SUCCESSORS 19 MOBILE ARENA DEVELOPMENTS 2 22 COBALT STRIKE STANDARDIZATION 26 CYBER ATTACK CATEGORIES BY REGION 28 GLOBAL THREAT INDEX MAP 29 TOP MALICIOUS FILE TYPES—WEB VS. EMAIL CHECK POINT SOFTWARE MID-YEAR REPORT 2021 31 GLOBAL MALWARE STATISTICS 31 TOP MALWARE FAMILIES 34 Top Cryptomining Malware 36 Top Mobile Malware 38 Top Botnets 40 Top Infostealers Malware 42 Top Banking Trojans 44 HIGH PROFILE GLOBAL VULNERABILITIES 3 47 MAJOR CYBER BREACHES (H1 2021) 53 H2 2021: WHAT TO EXPECT AND WHAT TO DO 56 PREVENTING MEGA CYBER ATTACKS 60 CONCLUSION CHECK POINT SOFTWARE MID-YEAR REPORT 2021 EXECUTIVE SUMMARY CHECK POINT SOFTWARE’S MID-YEAR SECURITY REPORT REVEALS A 29% INCREASE IN CYBERATTACKS AGAINST ORGANIZATIONS GLOBALLY ‘Cyber Attack Trends: 2021 Mid-Year Report’ uncovers how cybercriminals have continued to exploit the Covid-19 pandemic and highlights a dramatic global 93% increase in the number of ransomware attacks • EMEA: organizations experienced a 36% increase in cyber-attacks since the beginning of the year, with 777 weekly attacks per organization • USA: 17% increase in cyber-attacks since the beginning of the year, with 443 weekly attacks per organization • APAC: 13% increase in cyber-attacks on organizations since the beginning of the year, with 1338 weekly attacks per organization In the first six months of 2021, the global rollout of COVID-19 vaccines gave hope that we will be able to live without restrictions at some point—but for a majority of organizations internationally, a return to pre-pandemic ‘norms’ is still some way off.
    [Show full text]
  • Sonicwall Cyber Threat Report a Note from Bill
    2 0 SONICWALL 2 1 CYBER THREAT REPORT Cyber threat intelligence for navigating the new business reality sonicwall.com | @sonicwall Table of Contents A Note From Bill 3 Ransomware by Region 37 Introduction 4 Ransomware by Signature 38 2020 Global Cyberattack Trends 5 Ransomware by Industry 42 Top Data Exposures of 2020 6 Intrusion Attempts 44 Power Shifts Changing Future of Cybersecurity 7 Top Intrusion Attacks 46 Published CVEs Nearly Triple Since 2015 10 Intrusion Attempts by Region 47 Top 8 CVEs Exploited in 2020 10 Capture ATP and RTDMI 48 2020 Zero-Day Vulnerabilities 12 ‘Never-Before-Seen’ Malware 50 COVID Threats: Exploiting a Pandemic 13 Malicious Office and PDF Files 51 COVID-19-Related Attacks by Industry 14 Cryptojacking 52 2020’s Biggest Cybersecurity Events 16 Cryptojacking Attempts by Industry 56 Key Findings from 2020 19 IoT Malware Attacks 58 Malware Attempts 21 A Year in IoT Malware Attacks 62 Malware Spread 22 IoT Malware Attacks by Industry 64 Malware Risk by Country 24 Non-Standard Ports 66 Malware Spread by Country 30 Conclusion 67 Malware Attempts by Industry 31 About the SonicWall Capture Labs Threat Network 68 Encrypted Attacks 33 Featured Threat Researchers 69 Ransomware 35 About SonicWall 70 2 | 2021 SonicWall Cyber Threat Report A Note From Bill The World Economic Forum asked respondents in a recent Cyber-resiliency means expanding your focus beyond study which dangers will pose the largest threat to the world simply securing your network and your data, to ensuring over the next two years. business continuity in the event of an attack or some other Unsurprisingly for a pandemic year, “infectious diseases” unforeseen event.
    [Show full text]
  • Security Navigator 2021 Research-Driven Insights to Build a Safer Digital Society Security Navigator 2021 Foreword
    Security Navigator 2021 Research-driven insights to build a safer digital society Security Navigator 2021 Foreword In 2020 our 17 SOCs and 11 CyberSOCs analyzed more than 50 billion security events daily, solved over 45,000 security incidents, and led in excess of 195 incident response missions. Our world-class experts have digested all this unique information and synthesized our key findings in this report, to the benefit of our clients and of the broader cybersecurity community. Hugues Foulon Michel Van Den Berghe Executive Director of Chairman Orange Strategy and Cyber- Cyberdefense France and security activities at Group COO Orange Cyberdefense Orange Cyberdefense We are very pleased to release this edition of the Never has it been more important to get out of a Orange Cyberdefense Security Navigator. Thanks reaction-driven crisis mode back into the driver's to our position as one of the largest telecom seat. We need to protect freedom and safety in the operators in the world as Orange, and as a digital space, not only in crisis, but on our way into European leader in cybersecurity services as the future. Our purpose is to build a safer digital Orange Cyberdefense, we have a unique view society. of the cybersecurity landscape. In the past year our 17 SOCs and 11 CyberSOCs, The COVID-19 pandemic has disrupted the analyzed over 50 billion security events daily, physical and digital society and economy on an solved in excess 45,000 security incidents, and led unprecedented scale. It has fundamentally shifted more than 195 incident response missions to date.
    [Show full text]
  • Q3 Malware Trends: Ransomware Extorts Education, Emotet and Crypto Mining Malware Evolve, and Android Malware Persists Cyber Threat Analysis
    CYBER THREAT ® ANALYSIS By Insikt Group CTA-2020-1105 Q3 MALWARE TRENDS: RANSOMWARE EXTORTS EDUCATION, EMOTET AND CRYPTO MINING MALWARE EVOLVE, AND ANDROID MALWARE PERSISTS CYBER THREAT ANALYSIS Key Judgments • More threat actors will very likely adopt the ransomware extortion model as long as it remains profitable. • Educational institutions continue to be a prime target for ransomware operators. We believe that disruptions caused by the COVID-19 pandemic have made the networks of universities and school districts attractive targets because these organizations feel increased pressure to stay operational with minimal disruptions and are therefore more likely to pay ransoms quickly. • Reports of NetWalker attacks increased, and reports of Sodinokibi attacks decreased. However, it is possible that victims of Sodinokibi attacks are simply paying the ransom more often. Based on activity on underground forums, we suspect that the operators of Sodinokibi are continuing to expand their operations. • While we expect Emotet’s operators to continue to employ major pauses, it is highly likely that Emotet will continue to be This report is an extension of analysis Recorded Future released, which outlined a major threat and impact organizations across a variety of the trends in malware use, distribution, and development throughout Q1 and Q2 industries throughout the end of the year and into 2021. 2020. Insikt Group used the Recorded Future® Platform to look at mainstream news, security vendor reporting, technical reporting around malware, vulnerabilities, and • In Q3 2020, threat actors have increasingly augmented their security breaches, and dark web and underground forums from July 1 to September cryptocurrency mining malware by adding functionalities 30, 2020, to examine major trends to malware impacting desktop systems and mobile such as credential stealing or access capabilities.
    [Show full text]
  • (AGCS) Safety & Shipping Review 2021
    ALLIANZ GLOBAL CORPORATE & SPECIALTY Safety and Shipping Review 2021 An annual review of trends and developments in shipping losses and safety SAFETY AND SHIPPING REVIEW 2021 About AGCS Allianz Global Corporate & Specialty (AGCS) is a leading global corporate insurance carrier and a key business unit of Allianz Group. We provide risk consultancy, Property‑Casualty insurance solutions and alternative risk transfer for a wide spectrum of commercial, corporate and specialty risks across 10 dedicated lines of business. Our customers are as diverse as business can be, ranging from Fortune Global 500 companies to small businesses, and private individuals. Among them are not only the world’s largest consumer brands, tech companies and the global aviation and shipping industry, but also satellite operators or Hollywood film productions. They all look to AGCS for smart answers to their largest and most complex risks in a dynamic, multinational business environment and trust us to deliver an outstanding claims experience. Worldwide, AGCS operates with its own teams in 31 countries and through the Allianz Group network and partners in over 200 countries and territories, employing around 4,400 people. As one of the largest Property‑ Casualty units of Allianz Group, we are backed by strong and stable financial ratings. In 2020, AGCS generated a total of €9.3 billion gross premium globally. www.agcs.allianz.com 2 PAGE 4 Executive summary PAGE 10 Losses in focus: 2011 to 2020 Trends PAGE 18 1. The Covid factors PAGE 28 2. Larger vessels PAGE 38 3. Supply chains and ports PAGE 42 4. Security and sanctions PAGE 48 5.
    [Show full text]
  • News from the Darkside
    Security Now! Transcript of Episode #818 Page 1 of 22 Transcript of Episode #818 News from the DarkSide Description: This week we look at a new (and old) thread to our global DNS infrastructure. We ask what the heck Google is planning with two-step verification, and we examine a huge new problem with the Internet's majority of email servers. We look at the reality of Tor exit node insecurity, touch on a new sci-fi novel by a well-known author, share a bit of closing-the-loop feedback, then take a look at this latest very high- profile ransomware attack from a previously low-key attacker. High quality (64 kbps) mp3 audio file URL: http://media.GRC.com/sn/SN-818.mp3 Quarter size (16 kbps) mp3 audio file URL: http://media.GRC.com/sn/sn-818-lq.mp3 SHOW TEASE: It's time for Security Now!. Steve Gibson is here. Some serious security issues with the Exim email server. We're going to talk about a big infrastructure problem, the Colonial Pipeline hit by ransomware. What's it mean for infrastructure in general? And then Steve's got a Picture of the Week that's actually - I think it's an IQ test. It's all coming up next - you'll pass - on Security Now!. Leo Laporte: This is Security Now! with Steve Gibson, Episode 818, recorded Tuesday, May 11th, 2021: News from the DarkSide. It's time for Security Now! with this fellow right here, we call him James Tiberius Gibson, the captain of the good ship Security Now!.
    [Show full text]
  • Acronis Cyberthreats Report 2020 3
    Report 2020 Acronis Cyberthreats Report Cybersecurity trends of 2021, 2020 the year of extortion ጷ Cyberthreats Report 2020 Table of contents Introduction and Summary 3 Part 1. Key cyberthreats and trends of 2020 4 1. COVID-19 themed exploitations 5 2. Remote workers under attack 7 3. Cybercriminals focus on MSPs 9 4. Ransomware is still the number one threat 10 5. Simple backup and security are not enough anymore 12 Part 2. General malware threat 14 Ransomware threat 18 Part 3. Vulnerabilities in Windows OS and software 23 Third-party apps are vulnerable and being used by bad guys as well 25 Most commonly exploited applications worldwide 25 Part 4. What to look for in 2021 26 Acronis recommendations to stay safe in the current and future threat environment 28 AUTHORS: Alexander Ivanyuk Candid Wuest Senior Director, Product and Vice President of Cyber Technology Positioning, Acronis Protection Research, Acronis ACRONIS CYBERTHREATS REPORT 2020 3 Introduction and Summary Acronis was the first company to implement THE TOP FIVE NUMBERS OF 2020: complete integrated cyber protection to protect • 31% of global companies are attacked by all data, applications and systems. Cyber cybercriminals at least once a day protection requires researching and monitoring • Maze ransomware accounted for almost 50% of threats, as well as abiding by the Five Vectors of all known ransomware cases of Cyber Protection – safety, accessibility, privacy, authenticity, and security (SAPAS). As part of the • More than 1000 companies had their data strategy, we’ve established three Cyber Protection leaked after ransomware attacks Operation Centers (CPOC) around the world to • Microsoft patched close to 1,000 flaws in its monitor and research cyberthreats 24/7.
    [Show full text]
  • Threat Advisory Report
    BRAINTRACE THREAT ADVISORY REPORT MAY 13, 2021 TABLE OF CONTENTS BACKGROUND ..................................................................................................................................................... 2 ADMIN ACCOUNTS AND COMMANDS EXECUTED AS ROOT BY CISCO BUG ................................................ 2 A NEW QUALCOMM VULNERABILITY ............................................................................................................... 2 CRITICAL 21NAILS EXIM BUGS ........................................................................................................................... 3 CODECOV COVERAGE TOOL HACKED .............................................................................................................. 4 NEW TSUNAME DNS BUG ................................................................................................................................. 4 FIVEHANDS RANSOMWARE ANALYZED BY CISA ............................................................................................ 5 ACTIVE DOUBLEDRAG, DOUBLEDROP, AND DOUBLEBACK MALWARE STRAINS ...................................... 6 BUER MALWARE VARIANT RE-WRITTEN IN E-Z RUST.................................................................................. 9 NEW PINGBACK MALWARE TARGETING WINDOWS ................................................................................... 10 VULNERABILITIES DISCOVERED ACROSS APPLE'S PRODUCT LINES .......................................................... 11 AUTHENTICATION BYPASS VULNERABILITY
    [Show full text]
  • Ransomware Attacks Unpatched Exchange Servers
    BRAINTRACE THREAT ADVISORY REPORT MARCH 18, 2021 TABLE OF CONTENTS BACKGROUND ..................................................................................................................................................... 2 GOOGLE REMOVED 10 APPS INFECTED WITH DROPPERS FOR FINANCIAL TROJANS .............................. 2 WEAK ACLS IN ADOBE COLDFUSION ALLOW PRIVILEGE ESCALATION ...................................................... 3 ADOBE PUBLISHED UPDATES FOR ADOBE CREATIVE CLOUD DESKTOP, FRAMEMAKER, AND CONNECT VULNERABILITIES ............................................................................................................................. 4 UNPATCHED QNAP DEVICES TARGETED IN ATTACKS TO MINE CRYPTOCURRENCY ............................... 5 REDXOR MALWARE TARGETING LINUX SYSTEMS .......................................................................................... 5 RANSOMWARE ATTACKS UNPATCHED EXCHANGE SERVERS ...................................................................... 6 NIMZALOADER: STRANGE MALWARE LANGUAGE, HARDER TO DETECT ................................................... 7 DARKSIDE 2.0 RANSOMWARE PROMISES FASTEST EVER ENCRYPTION SPEEDS ...................................... 8 PROTECTING OUR SYSTEMS AGAINST NATION STATE THREAT ACTORS .................................................. 9 NANOCORE RAT MALSPAM CAMPAIGN ......................................................................................................... 10 A NEW HIGHLY DAMAGING RANSOMWARE ATTACK: HELLOKITTY...........................................................
    [Show full text]
  • Annual Report on Attacks and Vulnerabilities Seen in 2020
    Annual Report on Attacks and Vulnerabilities seen in 2020 Released on February 2021 Table of contents 1 Introduction .......................................................................................................................................... 3 2 What happened in 2020? ..................................................................................................................... 3 3 Analysis of the most striking phenomena of 2020 ............................................................................... 7 3.1 The cyber threat induced by the Covid-19 crisis .......................................................................... 8 3.2 Ransomware's Attacks against companies................................................................................. 10 3.3 Attacks against VPN Access and Exposed Appliances ................................................................ 12 3.4 Orion SolarWinds and Supply-chain attacks .............................................................................. 13 3.5 DDOS attacks .............................................................................................................................. 15 3.6 Increasingly Sophisticated State Attacks .................................................................................... 15 3.7 Technical developments observed in 2020 ................................................................................ 17 3.7.1 Attacks against Exchange, SharePoint and IIS ...................................................................
    [Show full text]
  • State of Ransomware 2021 Compiled by HG Threat Hunters Q1-Q2 State of Ransomware
    State of Ransomware 2021 Compiled By HG Threat Hunters Q1-Q2 State of Ransomware Contents Evolving Ransomware 3 Conti 4 REvil 5 Avaddon 6 CL0P 7 Darkside 8 Doppelpaymer 9 Babuk 10 Netwalker 11 Preventing and Responding to a Ransomware Incident 12 References 14 State of Ransomware - 2021 Q1 - Q2 Herjavec Group’s research Evolving Ransomware uncovered the following ransomware variants have In 2021, the average cost of recovery and ransom associated with a ransomware attack accrued the most data-leak has been 2 times more than the 2020 average global ransom demand[1]. During the victims so far in 2021: first two fiscal quarters of 2021, not only did ransomware attacks continue to become more targeted and sophisticated[2], but the most prolific “Double Extortion” ransomware operators have been observed holding enterprise networks hostage for eight figure Conti sums of up to $40M USD[3]. REvil Herjavec Group has analyzed the most active ransomware operations in the first two fiscal quarters of 2021 and created profiles on the highest-impact ransomware families and Avaddon their victimized industries. As expected, all of these ransomware operators were observed to demand payment via cryptocurrencies and leveraged sensitive data exfiltrated before CL0P the encrypting process to apply additional pressure on their victims in an attempt to increase the likelihood of a payout[4], [5]. Darkside Victims of Data-Leak Ransomware 39% DoppelPaymer Operations in the first half of 2021 Manufactured Goods 18% Babuk Technology & Technology Service Providers NetWalker 16% Public Sector & Legal Services 11% Finance 6% Healthcare 4% Education 3% Entertainment 3% Energy Many of these ransomware variants were observed sharing code similarities and Tactics, Techniques, and Procedures (TTPs) related to older variants observed in 2020 and earlier.
    [Show full text]
  • WEST VIRGINIA INSURANCE BULLETIN No. 21 - 05
    WEST VIRGINIA INSURANCE BULLETIN No. 21 - 05 Insurance Bulletins are issued when the Commissioner renders formal opinions, guidance or expectations on matters or issues, explains how new statutes or rules will be implemented or applied, or advises of interpretation or application of existing statutes or rules. ► Cybersecurity Alert ◄ In January 2021, the Cybersecurity and Infrastructure Security Agency (CISA) announced the Reduce the Risk of Ransomware Campaign, a focused, coordinated and sustained effort to encourage public and private sector organizations to implement best practices, tools and resources that can help them mitigate the cybersecurity risk and threat. As cybercrime becomes more common and costly, cyber risk continues to increase for all organizations. The COVID-19 pandemic has shifted more of our work and lives online. This shift has introduced new vulnerabilities that cybercriminals are aggressively exploiting. From the rise of ransomware to the recent JBS S.A. and Colonial Pipeline cyberattack campaigns, cybersecurity is now critically important to almost every aspect of modern life including consumer protection to national security. To increase awareness to ever-growing cybersecurity threats, the West Virginia Offices of the Insurance Commissioner is issuing this Cybersecurity Alert on ransomware. What is Ransomware? According to the U.S. Computer Emergency Readiness Team (“US-CERT”), ransomware is a specific type of malicious program (i.e., a virus) where the victim’s computer, network, and/or files become strongly encrypted to the point they are effectively rendered useless. Shortly after the victim realizes what happened, the victim typically receives a message demanding a ransom in exchange for restoring access to the affected systems.
    [Show full text]