Targeted Cybercrime On a Tear

CrowdStrike threat hunting data shows major increase in targeted financially motivated attacks in the first six months of 2019.

When it comes to targeted attacks, the volume of cybercrime campaigns actually overshadowed state-sponsored ones in the first half of this year. But that doesnt mean nation-state attacks declined.
New data published today from CrowdStrikes OverWatch threat-hunting service team shows that targeted cybercrime made up 61% of the targeted attacks CrowdStrike saw between January and June of 2019, a major spike from 2018, when it made up just 25% for the year. Nation-state attacks comprised 39% of the targeted attack campaigns in the first half of this year, versus 75% for all of last year.
We saw an uptick in the second half of last year [with targeted cybercrime] as big game hunting was on the rise. And this year so far has lent itself to a major uptick, says Jennifer Ayers, vice president of OverWatch and security response at CrowdStrike. There were more targeted cybercrime attack campaigns in the first half of the year, and an increase in hands-on keyboard activity, she says, as they burrowed through their victims networks.
Part of the reason for the surge in targeted cybercrime was the well-documented rise in ransomware attacks going after commercial businesses and organizations in order to net bigger ransom fees, aka big-game hunting. The attackers also have gotten more savvy about which critical servers to lock down in those attacks, ensuring bigger payouts. But the increase also had to do with cybercriminals doubling down on various types of data-stealing tools such as TrickBot, Ayers notes.
Overall, organizations report a surge in cyberattacks. A new global survey of CIOs, CTOs, and CISOs, by CrowdStrike rival Carbon Black shows that 84% of organizations have seen an increase in cyberattacks overall in the past 12 months, with 88% saying they suffered a data breach in that period. More than 80% report that attacks have gotten more advanced.
Nearly 45% suffered some financial damage from their breach, and 12% described the damage as severe.
China, according to CrowdStrikes new data, remains the most prolific of nation-state players, a trend that CrowdStrike and other security research teams have seen for some time. OverWatch analysts spotted Chinese groups targeting the chemical, gaming, healthcare, hospitality, manufacturing, pharmaceutical, technology, and telecommunications industries in the first half of the year.
Telecommunications was one of the hottest targets for both state-sponsored hackers and cybercriminals. Telecommunications is the new financial services when it comes to being a big target, Ayers notes. They are being hit really hard by multiple actors, but very interestingly, those actors all have different objectives.
While Chinas nation-state groups are after intellectual property as well as some telecom customer targets, cybercriminals are all about both stealing from telecom vendors for monetary gain but also using them as a stepping-stone to reach lucrative customer targets.
Meanwhile, the attackers are customizing legitimate IT tools such as CobaltStrike and Mimikatz, and employing tools like PC Hunter and Process Hacker to blend in and evade detection. They also are using legit tools to help them disable features of security tools in their targets networks. Security tools being targeted is not a new thing, Ayers notes, but since some newer-generation security tools are more difficult to disable, attackers are getting more aggressive in killing security tool processes and editing registries, or any other disruption to sneak past the tool.
What to Do About It
CrowdStrike recommends the usual security best practices for defense, including properly enabling the features in security tools such as machine learning and quarantining, and blocking known indicators of compromise. Too often, due to uncertainty associated with potential false positives and business interruption, preventative features are left disabled or set in monitor mode. As a result, attacks that could easily have been blocked get through, CrowdStrike said in
its report
today.
Behavioral analysis also can help catch nefarious activity that sneaks past traditional security controls, the company said.
Related Content:
8 Microsegmentation Pitfalls to Avoid
Chinese Group Built Advanced Trojan by Reverse Engineering NSA Attack Tool
US Mayors Commit to Just Saying No to Ransomware
19 Minutes to Escalation: Russian Hackers Move the Fastest
Check out
The Edge
, Dark Readings new section for features, threat data, and in-depth perspectives. Todays top story:
Why Clouds Keep Leaking Data

Last News
▸ Nigerian scammers now turning into mediocre malware pushers. ◂ Discovered: 23/12/2024 Category: security	▸ Beware EMV may not fully protect against skilled thieves. ◂ Discovered: 23/12/2024 Category: security	▸ Hack Your Hotel Room ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Targeted Cybercrime On a Tear