Sophistication, Speed, and Diversity of Attack Techniques Demonstrates Importance of Strengthening Entire Cyber Kill Chain
Fortinet, a global leader in broad, integrated, and automated cybersecurity solutions, recently announced the latest semiannual FortiGuard Labs Global Threat Landscape Report.
This latest Global Threat Landscape Report is a view representing the collective intelligence of FortiGuard Labs, drawn from Fortinet’s vast array of sensors collecting billions of threat events observed around the world during the second half of 2021. Similar to how the MITRE ATT&CK framework classifies adversary tactics and techniques, with the first three groupings spanning reconnaissance, resource development, and initial access, the FortiGuard Labs Global Threat Landscape Report leverages this model to describe how threat actors find vulnerabilities, build malicious infrastructure, and exploit their targets. The report also covers global and regional perspectives as well.
Commenting on this report, Michael Joseph, Director System Engineering, India & SAARC, Fortinet said, “Cybersecurity is a fast-moving and dynamic industry, but recent threat events show unparalleled speeds at which cyber adversaries are developing and executing attacks today. New and evolving attack techniques span the entire kill chain but especially in the weaponization phase, showing an evolution to a more advanced persistent cybercrime strategy that is more destructive and unpredictable. To protect against this broad scope of threats, organizations need to implement AI-powered prevention, detection, and response strategies based on a cybersecurity mesh architecture allowing for much tighter integration, increased automation, as well as a more rapid, coordinated, and effective response to threats across the extended network.”
Threat intelligence from the second half of 2021 reveals an increase in the automation and speed of attacks demonstrating more advanced persistent cybercrime strategies that are more destructive and unpredictable. In addition, the expanding attack surface of hybrid workers and hybrid IT is a focal point that cyber adversaries are attempting to exploit.
Log4j Demonstrates Dramatic Speed of Exploit Organizations Face: The Log4j vulnerabilities that occurred in late 2021 demonstrate the rapidly increasing speed of exploit that cybercriminals are attempting to leverage to their advantage. Despite emerging in the second week of December, exploitation activity escalated quickly enough, in less than a month, to make it the most prevalent IPS detection of the entire second half of 2021. In addition, Log4j had nearly 50x the activity volume in comparison to the well-known outbreak, ProxyLogon, that happened earlier in 2021. The reality is that organizations have very little time to react or patch today given the speeds that cyber adversaries are employing to maximize fresh opportunities. Organizations need AI and ML-powered intrusion prevention systems (IPS), aggressive patch management strategies, and the threat intelligence visibility to prioritize those threats propagating most quickly in the wild to reduce overall risk.
Adversaries Rapidly Targeting New Vectors Across the Attack Surface: Some lesser or low-lying threats have the potential to cause bigger problems in the future and are worthy of watching. An example is newly crafted malware designed to exploit Linux systems, often in the form of executable and linkable format (ELF) binaries. Linux runs the back-end systems of many networks and container-based solutions for IoT devices and mission-critical applications, and it is becoming a more popular target for attackers.
Botnet Trends Show a More Sophisticated Evolution of Attack Methods: Threat trends demonstrate that botnets are evolving to adopt newer and more evolved cybercriminal attack techniques. Instead of being primarily monolithic and focused mostly on DDoS attacks, botnets are now multipurpose attack vehicles leveraging a variety of more sophisticated attack techniques, including ransomware.
Malware Trends Show Cybercriminals Maximizing “Remote Everything:” Evaluating the prevalence of malware variants by region reveals a sustained interest by cyber adversaries in maximizing the remote work and learning attack vector. In particular, various forms of browser-based malware were prevalent. This often takes the form of phishing lures or scripts that inject code or redirect users to malicious sites.
Ransomware Activity Still High and Continues to Get More Destructive: FortiGuard Labs data reveals that ransomware has not subsided from peak levels over the last year and instead, the sophistication, aggressiveness, and impact of ransomware is increasing. Threat actors continue to attack organizations with a variety of new as well as previously seen ransomware strains, often leaving a trail of destruction. Old ransomware is being actively updated and enhanced, sometimes with wiper malware included, while other ransomware is evolving to adopt Ransomware-as-as-Service (RaaS) business models..
Deeper Understanding of Attack Techniques Can Help Stop Criminals Faster: Analyzing the attack goals of adversaries is important to be able to better align defenses against the speed of changing attack techniques. To observe the malicious outcomes of various attacks, FortiGuard Labs analyzed the functionality of detected malware by detonating the malware samples collected throughout the year. The result was a list of the individual tactics, techniques and procedures (TTPs) the malware would have accomplished if the attack payloads had been executed.
Protecting Against Fast-moving and Sophisticated Cyber Adversaries
As attacks continue to develop in sophistication and span the entire attack surface at increased speeds, organizations need solutions designed to interoperate rather than function in isolation. Securing against evolving attack techniques will require smarter solutions that know how to ingest real-time threat intelligence, detect threat patterns and fingerprints, correlate massive amounts of data to detect anomalies, and automatically initiate a coordinated response. Point products need to be replaced with a cybersecurity mesh platform that provides centralized management, automation and integrated solutions that work in concert.
