Story image

Carbon Black claims there's a link between geopolitics and cyberterrorism

25 Jul 2018

China, North Korea, and Russia are responsible of many of the world’s cyber attacks, and according to Carbon Black those countries are both operationalizing and supporting advanced cyber militias.

Those are some of the findings from the company’s Quarterly Incident Response Threat Report, which points the finger at the link between geopolitical tensions and increasing cyber warfare efforts.

“Geopolitical tensions manifest in cyberspace. There is a direct link between the failures of diplomacy and cyberespionage and cyberterrorism. The cold war adversaries have colonised wide swaths of Western cyberspace. This is compounded by the reality that organised crime syndicates have migrated their criminal conspiracies online,” says Carbon Black’s chief cybersecurity officer, Tom Kellermann.

According to the report, Russia is the origin point for most attacks, but China follows close behind. North America, Iran, North Korea, and Brazil also round out the top six.

Those intrusions are no longer reserved for select targets and they are a threat to all organizations, he continues.

According to the report, 31% of incident response professionals say that the reasons behind cyber attacks are not just financial gain or data theft, but also espionage.

Attackers are also moving laterally throughout systems – 59% of attacks use this tactic, which means they aren’t targeting one part of a system. Instead, they are moving around and seeing more targets as they go.

PowerShell is a popular tool of choice for attackers seeking lateral movement.

Attackers are also getting wise to organisations’ incident response strategies.

The report says that 46% of respondents say they’ve experienced instances of counter incident response.

“The cyber intrusions of today have evolved from burglary to home invasion. Today’s cyber intrusions are more persistent and more destructive.  In fact, the Cb Incident Response Threat Report noted that over 46% of cyber intrusions experiences counter-incident response e.g. The adversary was fighting back to remain in the system.  The same study noted that 10% have experienced destructive attacks,” Kellermann says.

Carbon Black also notes that because criminals can sniff out incident response strategies, those strategies must now evolve to become stealthier.

Finally, 36% of respondents say attackers now use victims for ‘island hopping’.

“In these campaigns, attackers first target an organization’s affiliates, often smaller companies with immature security postures. This means that not only is your data at risk, but so is the data at every point in the supply chain, including customers and partners,” Kellermann concludes.

The Quarterly Incident Response Threat Report quizzed 37 leading incident response organisations, all of which were Carbon Black partners.

Forget endpoints—it’s time to secure people instead
Security used to be much simpler: employees would log in to their PC at the beginning of the working day and log off at the end. That PC wasn’t going anywhere, as it was way too heavy to lug around.
DimData: Fear finally setting in amongst vulnerable orgs
New data ranking the ‘cybermaturity’ of organisations reveals the most commonly targeted sectors are also the most prepared to deal with the ever-evolving threat landscape.
IXUP goes "post-quantum" with security tech upgrade
The secure analytics company has also partnered with Deloitte as a reseller, and launched a SaaS offering on Microsoft Azure.
ExtraHop’s new partner program for enterprise security
New accreditations and partner portal enable channel partners to fast-track their expertise and build their security businesses.
Hackers increasingly ‘island hopping’ – so what does it mean?
Carbon Black's Rick McElroy discusses this new trend and what it means for the new age of cybercrime.
Trust without visibility is blind – Avi Networks
Enterprises are wanting to gain the trust of their customers, but are often found blindly defending themselves.
How to avoid becoming a cryptojacking victim - Bitglass
Large-scale cryptojacking is a lucrative business due to the popularity and value of cryptocurrencies like Bitcoin and Ethereum.
Symantec, Ixia combine efforts to secure hybrid networks
Ixia’s CloudLens and Symantec Security Analytics now feature complete integration, which allows Symantec customers to gain real-time visibility into their hybrid cloud environments.