Destructive Cyberattacks Spiked in Q3

New data gathered from more than three dozen providers of incident response services reveals a disturbing increase in the past quarter of destructive cyberattacks targeting US organizations.

What is not clear is whether the attacks—many of them from countries like China, Russia, and North Korea—are a response to the current geopolitical climate, or demonstrate increasingly punitive attempts by attackers to hide their tracks after being discovered.

Either way, the implications of the trend are serious for enterprises, says Tom Kellermann, chief security officer at Carbon Black, the security vendor behind the report. Between the second and third quarters of this year, there was a three-fold increase in destructive attacks where adversaries deleted or encrypted data, destroyed logs and backups, and caused system outages in ways designed to paralyze victims.

Thirty-two percent of the breaches that the 37 incident responders in Carbon Black's study investigated last quarter involved such attacks compared to 10% in the second quarter.

Compounding the severity of the situation was the fact that more than 50% of the attacks that the IR firms investigated involved so-called "island hopping," Kellermann says. These are attacks where threat actors target an organization so they can access an affiliate's network, like that belonging to a customer or partner. Thirty percent of victim organizations in the Carbon Black study saw their websites being turned into a watering hole by adversaries seeking to attack and associated company's network, he notes.

"Enterprises need to understand how their biggest customers and partners could be indirectly targeted either from or through their infrastructure," Kellerman says. "They need to do a better job of understanding East-West movement and do hunts and incident response in a more clandestine manner."

A lot of the data destruction and system disruption that incident responders encountered last quarter appears to be a manifestation of counter-incident response tactics by attackers.

Hackers Hacking IR

Instead of simply fleeing when discovered, many threat actors are instead actively engaging with incident responders and deploying counter measures of their own. In 51% of the incidents that IR providers investigated last quarter, adversaries attempted to erase antivirus and security logs and block IR teams from critical forensic data. More than four in ten organizations that experienced a security incident last quarter reported finding a secondary command and control (C2) passageway on their network that was triggered to wakeup if the primary C2 was discovered.

"We are dealing with more of an insurgency within our infrastructure," Kellermann says. "The louder or more active we become with our countermeasures, the more punitive," attackers are likely to get.

The fact that a substantial proportion of destructive attacks emanated from groups within countries currently at odds with the US make it possible that at least some of them are geopolitically motivated, Kellermann adds. Groups within China and Russia, for instance, accounted for 47% of all cyberattacks that IR providers responded to last quarter.

Interestingly, more than two-thirds of incident responders believe that groups from these countries will attempt to influence the US midterm elections via cyberattacks.

For enterprises, the trend towards more destructive attacks highlights the need to pay attention to incident detection and response. Organizations that haven't already done so should conduct a threat-hunting exercise to find potentially compromised assets, Kellermann says. Optimally, such exercises need to be conducted on a regular basis.

Also important are endpoint threat assessments and penetration tests from outside the enterprise infrastructure, and inside as well to detect potential paths that attackers could take to get to other affiliate networks. Use of deception technologies and out-of-band communication methods can also be useful in helping enterprises hide their incident response activity and not tip their hand off to the attackers, he says.

Related Content:

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.