Sonicwall Cyber Threat Report a Note from Bill
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
CYBER ATTACK TRENDS Mid Year Report 2021 CONTENTS
CYBER ATTACK TRENDS Mid Year Report 2021 CONTENTS 04 EXECUTIVE SUMMARY 07 TRIPLE EXTORTION RANSOMWARE—THE THIRD-PARTY THREAT 11 SOLARWINDS AND WILDFIRES 15 THE FALL OF AN EMPIRE—EMOTET’S FALL AND SUCCESSORS 19 MOBILE ARENA DEVELOPMENTS 2 22 COBALT STRIKE STANDARDIZATION 26 CYBER ATTACK CATEGORIES BY REGION 28 GLOBAL THREAT INDEX MAP 29 TOP MALICIOUS FILE TYPES—WEB VS. EMAIL CHECK POINT SOFTWARE MID-YEAR REPORT 2021 31 GLOBAL MALWARE STATISTICS 31 TOP MALWARE FAMILIES 34 Top Cryptomining Malware 36 Top Mobile Malware 38 Top Botnets 40 Top Infostealers Malware 42 Top Banking Trojans 44 HIGH PROFILE GLOBAL VULNERABILITIES 3 47 MAJOR CYBER BREACHES (H1 2021) 53 H2 2021: WHAT TO EXPECT AND WHAT TO DO 56 PREVENTING MEGA CYBER ATTACKS 60 CONCLUSION CHECK POINT SOFTWARE MID-YEAR REPORT 2021 EXECUTIVE SUMMARY CHECK POINT SOFTWARE’S MID-YEAR SECURITY REPORT REVEALS A 29% INCREASE IN CYBERATTACKS AGAINST ORGANIZATIONS GLOBALLY ‘Cyber Attack Trends: 2021 Mid-Year Report’ uncovers how cybercriminals have continued to exploit the Covid-19 pandemic and highlights a dramatic global 93% increase in the number of ransomware attacks • EMEA: organizations experienced a 36% increase in cyber-attacks since the beginning of the year, with 777 weekly attacks per organization • USA: 17% increase in cyber-attacks since the beginning of the year, with 443 weekly attacks per organization • APAC: 13% increase in cyber-attacks on organizations since the beginning of the year, with 1338 weekly attacks per organization In the first six months of 2021, the global rollout of COVID-19 vaccines gave hope that we will be able to live without restrictions at some point—but for a majority of organizations internationally, a return to pre-pandemic ‘norms’ is still some way off. -
2020 Sonicwall Cyber Threat Report
2020 SONICWALL CYBER THREAT REPORT sonicwall.com I @sonicwall TABLE OF CONTENTS 3 A NOTE FROM BILL 4 CYBERCRIMINAL INC. 11 2019 GLOBAL CYBERATTACK TRENDS 12 INSIDE THE SONICWALL CAPTURE LABS THREAT NETWORK 13 KEY FINDINGS FROM 2019 13 SECURITY ADVANCES 14 CRIMINAL ADVANCES 15 FASTER IDENTIFICATION OF ‘NEVER-BEFORE-SEEN’ MALWARE 16 TOP 10 CVES EXPLOITED IN 2019 19 ADVANCEMENTS IN DEEP MEMORY INSPECTION 23 MOMENTUM OF PERIMETER-LESS SECURITY 24 PHISHING DOWN FOR THIRD STRAIGHT YEAR 25 CRYPTOJACKING CRUMBLES 27 RANSOMWARE TARGETS STATE, PROVINCIAL & LOCAL GOVERNMENTS 31 FILELESS MALWARE SPIKES IN Q3 32 ENCRYPTED THREATS GROWING CONSISTENTLY 34 IOT ATTACK VOLUME RISING 35 WEB APP ATTACKS DOUBLE IN 2019 37 PREPARING FOR WHAT’S NEXT 38 ABOUT SONICWALL 2 A NOTE FROM BILL The boundaries of your digital empire are In response, SonicWall and our Capture Labs limitless. What was once a finite and threat research team work tirelessly to arm defendable space is now a boundless organizations, enterprises, governments and territory — a vast, sprawling footprint of businesses with actionable threat devices, apps, appliances, servers, intelligence to stay ahead in the global cyber networks, clouds and users. arms race. For the cybercriminals, it’s more lawless And part of that dedication starts now with than ever. Despite the best intentions of the 2020 SonicWall Cyber Threat Report, government agencies, law enforcement and which provides critical threat intelligence to oversight groups, the current cyber threat help you better understand how landscape is more agile than ever before. cybercriminals think — and be fully prepared for what they’ll do next. -
Igloosec Security Report
Monthly Security Report 2019 June Cyber attack prevention and detection automation using CTI & vulnerability assessment result CVE-2019-0708 (BlueKeep) Advanced social engineering hacking technique, aimed at people. This report is based on the data collected through the SIEM solution at IGLOO Security’s Security Operation Center (SOC). IGLOO Security continuously strives to achieve a 24/7 safe cyber environment throughout the year. -2 - MONTHLY SECURITY REPORT 201906 Cover Story 1. Monthly Security Issues - Monthly security issues 2. IGLOO Statistics - Monthly Attack Service and Trend Analysis - Detailed Analysis According to Different Patterns 3. SIEM Guide (SPiDER TM V5.x) 4. Tech Note - CVE-2019-0708 (BlueKeep) 5. Special Column - Advanced social engineering hacking techniques, aimed at people 6. Focus On IGLOO Security - Participation in the 2019 Defense Security Conference Information Security Product Exhibition -3 - MONTHLY SECURITY REPORT 201906 CHAPTER 1 Monthly Security Issues 1. Monthly security issues -4 - MONTHLY SECURITY REPORT 201906 1 Monthly Security Issues ‘For the next generation’… Gand Crab Ransomware creator announces discontinuation of Gand Crab • GandCrab Ransomware creator has earned $ 2 billion. Now attracting attention by announcing that it will no longer produce a service-oriented Ransomware (RaaS). • GandCrab Ransomware, which was first unveiled in January 2018, has recently appeared in the 5.2 version and produced a lot of damage. • According to the blip computer, the creator has invested in legitimate businesses by cashing in revenues from the company. The creator are expected to delete the entire cryptographic key along with the release of the Ransomware, and victims who want to retrieve the files encrypted by Gandcrab are prompted to pay for the decryption quickly. -
Security Navigator 2021 Research-Driven Insights to Build a Safer Digital Society Security Navigator 2021 Foreword
Security Navigator 2021 Research-driven insights to build a safer digital society Security Navigator 2021 Foreword In 2020 our 17 SOCs and 11 CyberSOCs analyzed more than 50 billion security events daily, solved over 45,000 security incidents, and led in excess of 195 incident response missions. Our world-class experts have digested all this unique information and synthesized our key findings in this report, to the benefit of our clients and of the broader cybersecurity community. Hugues Foulon Michel Van Den Berghe Executive Director of Chairman Orange Strategy and Cyber- Cyberdefense France and security activities at Group COO Orange Cyberdefense Orange Cyberdefense We are very pleased to release this edition of the Never has it been more important to get out of a Orange Cyberdefense Security Navigator. Thanks reaction-driven crisis mode back into the driver's to our position as one of the largest telecom seat. We need to protect freedom and safety in the operators in the world as Orange, and as a digital space, not only in crisis, but on our way into European leader in cybersecurity services as the future. Our purpose is to build a safer digital Orange Cyberdefense, we have a unique view society. of the cybersecurity landscape. In the past year our 17 SOCs and 11 CyberSOCs, The COVID-19 pandemic has disrupted the analyzed over 50 billion security events daily, physical and digital society and economy on an solved in excess 45,000 security incidents, and led unprecedented scale. It has fundamentally shifted more than 195 incident response missions to date. -
Catalogue Formations (PDF)
Page 2 L’intégrale VERISAFE Véritable cursus de formation en Cybersécurité : 120 heures de formation, 850 vidéos & 4200 slides La cybercriminalité fait peser une menace grandissante sur tous les organismes (privés ou pu- blics) et sur chaque citoyen. Pour lutter efficacement contre ce fléau, il est important de bien comprendre le phénomène et de l’anticiper. Illustrée par des exemples réels, cette formation détaille le monde cybercriminel (organisation, acteurs, motivations, techniques d’attaques, moyens financiers et humains,…). Elle présente également les acteurs et les dispositifs juri- diques pour lutter contre les cybercriminels au niveau national comme au niveau international. Face une véritable pénurie en matière de compétences en matière de sécurité Cloud, la certifi- cation CCSK de la Cloud Security Alliance est devenue la certification internationale la plus re- cherchée et se place désormais à la 1er place en matière de rémunération (Source : Certificate Magazine). Cette formation intensive a été spécialement conçue pour préparer et obtenir cette certification en 30 jours. Ransomware, espionnage économique ou scientifique, fuites de données à caractère person- nel,… le nombre de cyberattaques ne cesse d’augmenter en France et dans le monde. La ques- tion n’est donc pas de savoir si votre organisme sera attaqué mais plutôt comment répondre efficacement à ces attaques. Cette formation répond à toutes les préoccupations actuelles et dresse l’état de l’art en matière de cybersécurité à destination des entreprises et des adminis- trations. C’est la formation Cybersécurité le plus suivie en France avec 18 sessions en présentiel et plus de 316 participants en 2019. Cette formation intensive permet d’acquérir toutes les compétences nécessaires pour devenir un professionnel de la cybersécurité reconnu sur le marché. -
Q3 Malware Trends: Ransomware Extorts Education, Emotet and Crypto Mining Malware Evolve, and Android Malware Persists Cyber Threat Analysis
CYBER THREAT ® ANALYSIS By Insikt Group CTA-2020-1105 Q3 MALWARE TRENDS: RANSOMWARE EXTORTS EDUCATION, EMOTET AND CRYPTO MINING MALWARE EVOLVE, AND ANDROID MALWARE PERSISTS CYBER THREAT ANALYSIS Key Judgments • More threat actors will very likely adopt the ransomware extortion model as long as it remains profitable. • Educational institutions continue to be a prime target for ransomware operators. We believe that disruptions caused by the COVID-19 pandemic have made the networks of universities and school districts attractive targets because these organizations feel increased pressure to stay operational with minimal disruptions and are therefore more likely to pay ransoms quickly. • Reports of NetWalker attacks increased, and reports of Sodinokibi attacks decreased. However, it is possible that victims of Sodinokibi attacks are simply paying the ransom more often. Based on activity on underground forums, we suspect that the operators of Sodinokibi are continuing to expand their operations. • While we expect Emotet’s operators to continue to employ major pauses, it is highly likely that Emotet will continue to be This report is an extension of analysis Recorded Future released, which outlined a major threat and impact organizations across a variety of the trends in malware use, distribution, and development throughout Q1 and Q2 industries throughout the end of the year and into 2021. 2020. Insikt Group used the Recorded Future® Platform to look at mainstream news, security vendor reporting, technical reporting around malware, vulnerabilities, and • In Q3 2020, threat actors have increasingly augmented their security breaches, and dark web and underground forums from July 1 to September cryptocurrency mining malware by adding functionalities 30, 2020, to examine major trends to malware impacting desktop systems and mobile such as credential stealing or access capabilities. -
(AGCS) Safety & Shipping Review 2021
ALLIANZ GLOBAL CORPORATE & SPECIALTY Safety and Shipping Review 2021 An annual review of trends and developments in shipping losses and safety SAFETY AND SHIPPING REVIEW 2021 About AGCS Allianz Global Corporate & Specialty (AGCS) is a leading global corporate insurance carrier and a key business unit of Allianz Group. We provide risk consultancy, Property‑Casualty insurance solutions and alternative risk transfer for a wide spectrum of commercial, corporate and specialty risks across 10 dedicated lines of business. Our customers are as diverse as business can be, ranging from Fortune Global 500 companies to small businesses, and private individuals. Among them are not only the world’s largest consumer brands, tech companies and the global aviation and shipping industry, but also satellite operators or Hollywood film productions. They all look to AGCS for smart answers to their largest and most complex risks in a dynamic, multinational business environment and trust us to deliver an outstanding claims experience. Worldwide, AGCS operates with its own teams in 31 countries and through the Allianz Group network and partners in over 200 countries and territories, employing around 4,400 people. As one of the largest Property‑ Casualty units of Allianz Group, we are backed by strong and stable financial ratings. In 2020, AGCS generated a total of €9.3 billion gross premium globally. www.agcs.allianz.com 2 PAGE 4 Executive summary PAGE 10 Losses in focus: 2011 to 2020 Trends PAGE 18 1. The Covid factors PAGE 28 2. Larger vessels PAGE 38 3. Supply chains and ports PAGE 42 4. Security and sanctions PAGE 48 5. -
News from the Darkside
Security Now! Transcript of Episode #818 Page 1 of 22 Transcript of Episode #818 News from the DarkSide Description: This week we look at a new (and old) thread to our global DNS infrastructure. We ask what the heck Google is planning with two-step verification, and we examine a huge new problem with the Internet's majority of email servers. We look at the reality of Tor exit node insecurity, touch on a new sci-fi novel by a well-known author, share a bit of closing-the-loop feedback, then take a look at this latest very high- profile ransomware attack from a previously low-key attacker. High quality (64 kbps) mp3 audio file URL: http://media.GRC.com/sn/SN-818.mp3 Quarter size (16 kbps) mp3 audio file URL: http://media.GRC.com/sn/sn-818-lq.mp3 SHOW TEASE: It's time for Security Now!. Steve Gibson is here. Some serious security issues with the Exim email server. We're going to talk about a big infrastructure problem, the Colonial Pipeline hit by ransomware. What's it mean for infrastructure in general? And then Steve's got a Picture of the Week that's actually - I think it's an IQ test. It's all coming up next - you'll pass - on Security Now!. Leo Laporte: This is Security Now! with Steve Gibson, Episode 818, recorded Tuesday, May 11th, 2021: News from the DarkSide. It's time for Security Now! with this fellow right here, we call him James Tiberius Gibson, the captain of the good ship Security Now!. -
Bluekeep Vulnerability
Monthly Cybersecurity Newsletter June 2019 Issue Enterprise Security and Risk Management Office (ESRMO) From the Desk of the State Chief Risk Officer – Maria Thompson BlueKeep Vulnerability The National Security Agency (NSA) has released a cybersecurity advisory for a vulnerability (CVE-2019-0708) called “BlueKeep” that affects several old versions of the Microsoft Windows operating system. The BlueKeep vulnerability allows for an unauthenticated attacker to connect to a vulnerable system using the Remote Desktop Protocol (RDP) – formerly known as Terminal Services – and send specially crafted requests without user interaction. An attacker who successfully exploits this vulnerability could then install programs; view, change, or delete data; or create new accounts with full user rights on the vulnerable machine. Microsoft warns that the vulnerability is also “wormable,” meaning it can potentially spread from system to system without user interaction. The “BlueKeep” vulnerability is present in Windows 7, Windows XP, and Server 2003 and 2008. Windows 8 and Windows 10 are not currently vulnerable. Although Microsoft has issued a patch for this vulnerability, potentially millions of machines are still vulnerable. Microsoft strongly recommends installing the updates for this vulnerability as soon as possible, after appropriate testing. The update addresses the vulnerability by correcting how Remote Desktop Services (RDS) handles connection requests. In addition to installing the patch, the following steps may also help reduce the risk of this vulnerability. • Disable RDS if it is not required. Disabling unused and unneeded services reduces exposure to security vulnerabilities. • Enable Network Level Authentication (NLA) on systems running supported Windows editions. With NLA turned on, an attacker would first need to authenticate to RDS with a valid account on the target system before exploiting the vulnerability. -
Chrome's Root Program
Security Now! Transcript of Episode #791 Page 1 of 27 Transcript of Episode #791 Chrome's Root Program Description: This week we examine a serious newly revealed Windows zero-day flaw, a public service reminder from Microsoft, Google's newly announced plan to get into the VPN service business, CERT's unappealing plan for automatic vulnerability naming, and a real mess that WordPress just made of an incremental security update to 455 million sites. Then we'll close a loop, I'll update about SpinRite, and we'll finish by examining Google's new plan to go their own way with a new Chromium browser certificate Root Store. High quality (64 kbps) mp3 audio file URL: http://media.GRC.com/sn/SN-791.mp3 Quarter size (16 kbps) mp3 audio file URL: http://media.GRC.com/sn/sn-791-lq.mp3 SHOW TEASE: It's time for Security Now!. Steve Gibson is here. Coming up in just a little bit a new Windows zero-day that's been around since Windows 7. A screw-up in patching for WordPress, you're going to want to know about that. And Steve's Dumb Idea of the Week. All I can say is stay tuned. Security Now! is coming up next. Leo Laporte: This is Security Now! with Steve Gibson, Episode 791, recorded Tuesday, November 3rd, 2020: Google's Root Program. It's time for Security Now!, and I mean right now, with this guy right here, Steve. Well, there is an exclamation mark in the title. That means it's definitely Security Now!. -
Exploit Kits, Which Seemed Nearly Dormant Last Year Following the Demise of Illicit Cryptocurrency Mining, the Hot New Thing in 2018, Appear to Be Making a Comeback
2020 TRUSTWAVE GLOBAL SECURITY REPORT Table of Contents Introduction ........................ 3 Threat Intelligence .................22 Email Threats ......................... 23 Executive Summary ................. 4 Extortion Scams ....................... 25 Data Compromises ..................... 4 Archive Mutant Tricks .................. 28 Email Threats .......................... 6 Multi-Stage Phishing Using Web Attacks ........................... 8 Trusted Cloud Providers ................ 29 Exploits ............................... 8 Office 365 Account Phishing ............30 Malware ............................... 9 Emotet: The Threat is in the Mail ......... 33 Database and Network Security ......... 10 Web Attacks .......................... 36 Database Compromise ...............11 Humans: The Lowest Hanging Fruit ....... 38 Compromise Demographics ..............11 Exploits .............................. 39 Compromises Per Environment ...........14 Finding Insights Through Trustwave Fusion ......................44 Environments Compromised by Industry ............................15 Malware ..............................46 Compromises by Region .................17 More and More Magecart ...............50 Compromise Duration ...................18 The State of Security ............... 51 Methods of Compromise .................19 Data Security ......................... 52 Sources of Detection ...................20 Network Security ...................... 56 Contributors ....................... 59 2 Introduction Welcome to the 2020 Trustwave -
Bluekeep Update 12/05/2019
BlueKeep Update 12/05/2019 Report #: 201912051000 Agenda • What is BlueKeep • Timeline of BlueKeep • BlueKeep Today • Initial Attempts to Exploit BlueKeep • Why Initial Attempts Failed • BlueKeep Tomorrow • Mitigations • Indicators of Compromise (IOCs) • HC3 Contact Information • References Slides Key: Non-Technical: managerial, strategic and high-level (general audience) Technical: Tactical / IOCs; requiring in-depth knowledge (sysadmins, IRT) TLP: WHITE, ID# 201912051000 2 What is BlueKeep • BlueKeep (CVE-2019-0708) • Vulnerability in Microsoft’s (MS) Remote Desktop Protocol • Grants hackers full remote access and code execution on unpatched machines • No user interaction required • Essential owns the machine, malicious actor can do as they please • Affects: Windows XP, 7, Server 2003, Server 2008, and Server 2008 R2 • Deja Blue(Related BlueKeep Vulnerabilities) affects: Windows 8, 10, and all older windows versions • EternalBlue affects: Server Message Block version 1 (SMBv1) • “Wormable” meaning it has the ability to self propagate (think WannaCry level of damage) • MS, NSA, DHS, many other security vendors released advisories and warning on this exploit TLP: WHITE, ID# 201912051000 3 BlueKeep Timeline Metasploit Team Microsoft Released Patch: DHS Tested a Working BlueKeep Scanner Significant Uptick in Releases BlueKeep Coin Miner Exploit CVE-2019-0708 Exploit Against W2000 Discovered in Malicious RDP Activity Exploit Module BlueKeep Vulnerability Watchdog Malware 34 Days (Private Exploit) 70 Days (Semi-Public Exploit) 115 Days (Public