THREAT INTELLIGENCE REPORT 2020 REWTERZ – THREAT INTELLIGENCE REPORT 2020 EXECUTIVE SUMMARY Rewterz provides Managed Security Services and Threat Intelligence services to organizations across continents. To keep cybersecurity professionals updated with relevant emerging threats, our Threat Intelligence team releases blogs, advisories and alerts regularly. Rewterz Threat Intelligence annually releases a consolidated Threat Intelligence report to summarize the most prominent cyber threats from the past year, detected and highlighted by our various Security Operations Centers and sensors. Aiming to provide security teams with helpful information for improved organizational security, this report consolidates findings of multiple security operations centers and sensors deployed across multiple organizations. Rewterz Threat Intelligence team analyzes data from hundreds of thousands of protected endpoints and servers, as well as from other sources that track phishing, attack campaigns, spoofing, identity theft, financial fraud and other fraudulent activities. Our team brings forth this valuable real-time data to equip organizations against cyber-attacks beforehand. Rewterz Threat Intelligence Platform utilizes numerous attack sensors collecting data of malicious events from global threat feeds, making it the most comprehensive and advanced threat intelligence gathering network in the country. With evolution in cybercrimes, safeguarding your sensitive information needs to be prioritized to save the integrity, availability and confidentiality of your organization. To cope with growing techniques of cyber-crimes, our SOC team uses most advanced threat intelligence and manages the real-time data of threat landscape through our Security Orchestration Automation and Response (SOAR) platform, SIRP. Our orchestration and automation platform helps reduce the redundant processes of incident handling and lets analysts focus on more complex tasks. SIRP automates the usage of Threat Intelligence data for our SOC teams, equipping them for smooth incident handling, vulnerability management, access control regulation and risk management, meanwhile saving considerable amount of their time. Rewterz has now mastered the art of threat intelligence and is ready to help you proactively fortify your defenses and mitigate threats. Through this report, we aim to share and dissipate knowledge about sophisticated threats and advanced attacker practices in use on the Internet today. This report enables readers to gain clear insight on the nature of the threats currently faced by organizations operating in the cyber world. Using the collected statistics, this report draws a clear picture of the threat landscape and informs about global threat practices used by attackers. This extensive report contains analysis on the major attacks detected during last 10 months. It includes the top attacking countries, most common malwares deployed, most active Advanced Persistent Threats, top phishing campaigns, top-targeted ports, most common attack vectors, most targeted industries, most exploited vulnerabilities and much more. We hope that you find this report useful. Feel free to contact us with any feedback. 1 REWTERZ – THREAT INTELLIGENCE REPORT 2020 For every organization operating in the cyber space, THREAT INTELLIGENCE understanding security vulnerability and the utility of threat intelligence is no more a question of choice. With the AND DECISION MAKING ever-growing techniques of cyber-attacks, every organization needs optimum measures to protect its information against economical, informational or privacy breaches. For that purpose, it’s important for organizations to understand the implications of threat intelligence data. The information in this report is structured to ensure maximum understanding and utility for the readers. Threat Intelligence is an inevitable component of decision-making processes and helps in crafting strategies for handling information security. It also guides organizations about the nature of staff-training that their cybersecurity demands. Apart from the situational awareness and foresight needed to improve the resilience of your critical business operations, Threat PROTECTION Intelligence also provides tangible benefits by highlighting on-going threats in your industry. To change reactive approach to a proactive approach, Threat Intelligence helps predict and target threat factors before they turn into an attack. This translation of cyber threats into business concerns and risks will eventually trigger an active defense mechanism. Moreover, effectiveness of security controls needs to be measured to justify their investment. Enterprises need to make sure that their security controls will protect business assets from a potential breach. VISA Lorem ipsum dolor sit amet 5656 343 787 888 Therefore, Threat Intelligence through latest vulnerabilities helps determine the security coverage and threat exposure that these controls add to an organization’s cybersecurity. 2 REWTERZ – THREAT INTELLIGENCE REPORT 2020 TOP INCIDENTS BY INDUSTRY Most cyber incidents in the past ten months were observed in the IT industry. Finance sector has also seen major cyber incidents whereas Manufacturing, Healthcare and Education industries follow up closely. 60 Information Technology Finance 50 55% Manufacturing Information Technology Education 40 Healthcare Fintech Transportation 30 20 15% Finance 10% Manufacturing 08% 08% 10 Education Healthcare 03% Fintech 01% Transportation 0 3 REWTERZ – THREAT INTELLIGENCE REPORT 2020 TOP DATA BREACHES BY INDUSTRY Deliberate data breaches in the past ten months have targeted many industries. Due to COVID19’s transformation of the cyberspace, Healthcare industry becomes the top targeted in last five months, with Finance dropping down to second. However, Manufacturing, Information and Education industries still remain to be popular targets for cyber criminals. 24% Healthcare Transportation 03% 21% Finance Fintech 07% Education 10% 18% Manufacturing Information Technology 17% 4 REWTERZ – THREAT INTELLIGENCE REPORT 2020 TOP ATTACKS Following are the top attacks detected by our Security Operations Centers and sensors. 50% of the attacks were that of HTTP tunneling whereas around 27% attacks were that of Anonymous SSL Cipher Negotiation. TCP denial of service attacks attribute to around 13% of the attacks detected by our Security Operations Centers and sensors. ATTACKS % 50 HTTP Tunneling 50 Anonymous SSL Cipher Negotiation 27 TCP Denial of Service 13 40 TCP Sync Flooding 3 HTML code Obfuscation 3 30 Excessive Request on TCP Port 0 1 Traceroute Enumeration Attack 1 HTTP Null Session Attack 1 20 UDP Flooding Attack 1 UPNP SSDP DOS attacks 0 10 0 5 REWTERZ – THREAT INTELLIGENCE REPORT 2020 TOP WEB APPLICATION ATTACKS Our Security Operations Centers and sensors detected that around 50% of the web application attacks are that of Illegal Resource Access, with highest percentage of them originating from Russia. SQL Injection attacks ranked second in web application attacks (24%), with prominent origination from USA. Brute Force Attacks on web applications amounted to around 10%, in which Netherlands was observed to have been very active. 02% Denial of Service 07% Saudi Arabia Cross Site Scripting China 10% 50% Brute Force Illegal Resource Access Netherlands Russia 24% Sql Injection USA 6 REWTERZ – THREAT INTELLIGENCE REPORT 2020 TOP ATTACKING COUNTRIES In the past ten months, Russia topped the list of countries from where most cyberattacks originated. United States went down to second from being first in 2019, whereas the cyberspace of Netherlands, China and Australia are also responsible for considerable number of cyberattacks. Below is a list of top attacking countries in the past ten months. 34% Russia 1% 32% UK USA 3% 7% France China 3% 3% 12% Saudi Arabia UAE Netherlands 2% 3% South Africa Australia 7 REWTERZ – THREAT INTELLIGENCE REPORT 2020 TOP ATTACKING IP ADDRESSES TOP ATTACKED PORTS A very high percentage of detected cyberattacks (66%) originated from the IP The most targeted port remains to be 443, bearing 50% of the detected address 66.115.169.210. This was followed by around 10% of the attacks attacks, up from 40% in August 2019. Other ports like 80, 25 and 445 continue originating from the IP address 95.85.51.71. Our Security Operations Centers to appear in the list of top-targeted ports. Ports 389 and 123 emerge as new also detected other malicious IP addresses, some of which are given below. highly targeted ports. 66% 66.115.169.210 PORTS % 95.85.51.71 10% 443 (HTTPS) 50 6% 27.78.14.83 389 (LDAP) 12 123 (NTP) 10 14.177.232.130 5% 25 ( SMTP) 9 4% 116.105.216.179 80 (HTTP) 7 176.113.70.60 4% 22 (SSH) 7 2% 89.248.174.216 445 (SMB) 3 993 (IMAPS) 1 5.101.0.209 1% 853 (DNS over TLS) 1 1% 43.252.220.111 4500 (IPSec) 0 222.186.173.238 1% 8 REWTERZ – THREAT INTELLIGENCE REPORT 2020 TOP C2 HOSTING COUNTRIES TOP CNC SERVERS Highest number of detected Command and Control servers were hosted in Listed below are the top most malicious Command and Control servers the United States. The cyberspace of France, Netherlands and Russia also detected, based on the number of callbacks. hosted considerable number of C2 servers. Others are listed below. www[.]iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff[.]com COUNTRIES % www[.]iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com gvaq70s7he[.]ru USA 39 5isohu[.]com France 12 www[.]aieov[.]com Netherlands 9 104.24.125[.]118 Russia 9 104.24.124[.]118 Brazil 9 Okonewacon[.]com Germany 6 69.197.156[.]194