[securityintelligence] Raising the Bar for APT Protection : Security Intelligence 2.0

Advanced Persistent Threats (APTs), or Advanced Targeted Threats as Gartner calls them, are now top of mind with security professionals, C-level executives and Boards of Directors.

All brands – as well as major events such as the London Olympics — are now being targeted by ever increasingly sophisticated attackers and techniques, whether the intent is to steal corporate intellectual property (Lockheed, RSA), disrupt websites to bring attention to a particular cause (FBI, MPAA), or steal customer data (LinkedIn, Epsilon, etc.).

[scmagazine] Seven-year-long APT campaign identified, possibly state-sponsored

Adam Greenberg, Reporter

An advanced persistent threat (APT) known as Careto, or “The Mask,” has been identified by Kaspersky Lab researchers – who have also suggested the cyber-espionage operation dating back to 2007 could be a state-sponsored campaign.

Government institutions, diplomatic offices and embassies, research institutions, private equity firms, activists, and energy, oil and gas companies are among the groups being targeted in 31 countries, according to a Kaspersky Lab blog post, which adds that while the greatest number of victims were in Morocco, several were in the United States and United Kingdom.

[securityaffairs] Cost of conducting APT campaigns is dramatically dropping

by paganinip on February 9th, 2014

Speaking at Kaspersky Lab’s Industry Analyst Summit Costin Raiu, revealed that the cost for APT campaign is dramatically dropping.

The cost of developing advanced malware has fallen dramatically malicious code likeStuxnet and Flame are today economically more affordable. It has been estimated that the expense for the development of a cyber weapon like Stuxnet,or for a sophisticated spyware like Duqu, is collapsed from $100 million to just $10,000.

[fireeye] Targeted Attacks in 2013: Israel

Continuing our region-by-region analysis of the global threat landscape, we turn to Israel, which faces unique cyber threat challenges. Cyber terrorism and cyber warfare are two of the biggest threats facing Israel, says Israeli Deputy Foreign Minister Ze’ev Elkin.

Well-funded and highly motivated threat actors have evolved their techniques from generic, opportunistic, and scattershot attacks to an approach that is targeted, resilient, and evasive.
The findings, based on data gleaned from FireEye Dynamic Threat Intelligence (DTI), are alarming:

• More than 1.5 APTs per hour were detected
• 40 APT variants were identified
• More than half of all callbacks from Israeli targets appear to contact first-tier CnC nodes based in the U.S.
• The volume of detected malware quadrupled between January and December
• Defense/airlines, government, and financial services were the most-targeted verticals

Figure 1 shows the volume of cyber attacks aimed at Israeli systems over the last year.

Figure 1: Attacks, by volume
April and September 2013 Surges
Some spikes in activity can be tied to external events:

• April/May 2013: This surge possibly stemmed from an Anonymous campaign (#op-Israel) launched against Israel in April. And a group supporting embattled Syrian president Bashar al-Assad reportedly attacked Israeli infrastructure in May in an attempt to retaliate against a Israeli bombing in Syria.
• September/October 2013: The Jewish New Year holiday lasted through September, giving threat actors an opening to infiltrate organizations during worker vacations.

APTs are an everyday reality
Figure 2 shows the types of attacks against Israeli systems in 2013 by category.

Figure 2: Detected cyber attacks,  by type
Common viruses remain the most common form of attack. But APTs are second at a whopping 25 percent of all attacks.
(Although backdoors, Trojans, info stealers, malware binaries, and malicious URLs are all used in APT attacks, they also enable a wide range of broader attacks, such as cyber crime. The APT category in Figure 2 includes only advanced targeted attacks, even if they involved components listed in other categories.)