Vulnerabilities / Threats

1/31/2018
04:20 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Lazarus Group, Fancy Bear Most Active Threat Groups in 2017

Lazarus, believed to operate out of North Korea, and Fancy Bear, believed to operate out of Russia, were most referenced threat actor groups in last year's cyberattacks.

The busiest threat actor groups of 2017 were Sofacy (otherwise known as Fancy Bear or APT28) and the Lazarus Group, security experts report. As these groups ramped up activity, threat actors operating out of China became quiet.

Analysts at AlienVault leveraged data from its Open Threat Exchange (OTX) threat intelligence sharing platform to take a broad look at threat patterns from last year. They found the most frequently referenced threat group in 2017 was Sofacy.

Ten years ago, Sofacy primarily targeted NATO and defense ministries. Over the past three years its operations have expanded to target businesses, individuals, and elections in the United States and France. Leaked information from the US government, and an official report from the German government, indicate the threat group is associated with Russian military intelligence.

The second most active group was Lazarus, which is believed to operate out of North Korea (or Democratic People's Republic of Korea, DPRK).

"In the past, security researchers thought DPRK cyber adversaries were unsophisticated compared to more traditional nation-state adversary groups, like China or Russia," says Dmitri Alperovitch, cofounder and CTO at CrowdStrike.

"However, the North Korea regime has invested significant resources in training and development in recent years and their cyber capabilities have matured significantly as a result." Alperovitch points out that in 2017, cyber operations were linked to DPRK almost monthly. Lazarus was linked to WannaCry and has hacked into banks and cryptocurrency exchanges.

Crowdstrike found Lazarus is comprised of four groups: Silent Chollima, Stardust Chollima, Labyrinth Chollima, and Ricochet Chollima. Most adversaries focus on targeted attacks or cyberespionage; DPRK threat actors aren't as particular. While they primarily focused on South Korean targets in 2017, they have been known to hit organizations in other regions.

What usually motivates these groups? John Bambenek, manager of threat systems at Fidelis Cybersecurity, says financial gain is often a driver. "You're dealing with organized crime, in essence," he explains. "There's a payday at the end of it."

Attackers, specifically those in North Korea, have begun turning to cryptocurrency. More are targeting consumer devices and leveraging their computing power to mine crypto. "For a nation that is highly sanctioned with currency requirements, Bitcoin and its related cousins provided great means to capitalize," Bambenek points out.

The goals of nation-state threat actors will vary from group to group. Those looking for money could target cryptocurrency exchanges while those seeking to disrupt election cycles could target social media to spread disinformation. "It depends on the geopolitical circumstances," he says.

Why Chinese threat groups fell silent

AlienVault's data shows Stone Panda, also known as APT10 or CloudHopper, fell in tenth place for 2017 activity. This is the highest-ranked group operating out of China, and AlienVault threat engineer Chris Doman notes its ranking "would have been very different three years ago."

The last year saw a significant decrease in the number of targeted attacks from China-based threat groups against Western businesses. While this followed political pressure and agreements to stop activity, it's also possible their attacks have become tougher to detect. CloudHopper is known to hit targets by compromising major IT service providers, a method that's difficult to detect for vendors and government agencies.

"We may continue to see reported activity from groups in China drop further," Doman writes, adding that UPS (also known as Boyusec or APT3) switched from Western to domestic targets.

What should you worry about?

Alperovitch warns businesses to worry about the danger North Korean threat groups pose to their brands and networks. "These adversaries have demonstrated a degree of unpredictability about what they may try to do next," he says. "It is important for organizations to continually hunt their systems for potential intrusions and swiftly remediate before any damage is done."

Bambenek acknowledges the potential for ICS-based attacks, which he says will be a growing area of focus for threat groups. "Someone will take a utility hostage for ransom," he says. "With Triton getting published to GitHub, we've drastically lowered the bar for ICS attacks."

Related Content:

Kelly Sheridan is Associate Editor at Dark Reading. She started her career in business tech journalism at Insurance & Technology and most recently reported for InformationWeek, where she covered Microsoft and business IT. Sheridan earned her BA at Villanova University. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
13 Russians Indicted for Massive Operation to Sway US Election
Kelly Sheridan, Associate Editor, Dark Reading,  2/16/2018
Facebook Aims to Make Security More Social
Kelly Sheridan, Associate Editor, Dark Reading,  2/20/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.