Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

9/25/2020
02:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Navigating the Asia-Pacific Threat Landscape: Experts Dive In

At next week's virtual Black Hat Asia, threat intelligence pros will discuss the threats local organizations should prioritize and how they can prepare.

Cyberattacks keeping CISOs up at night vary by geography, as do strategies for protecting the business from compromise. In the Asia-Pacific region, for example, threat intelligence experts say evolutions in ransomware, long dwell time, and local nation-state actors are top of mind. 

"I've seen a huge uptick in terms of the evolution of the ransomware threat space," says Steve D'sa, director of consulting for Mandiant, in a discussion of online attacks targeting Asia-Pacific organizations.

Related Content:

Malware Attacks Declined But Became More Evasive in Q2

State of Endpoint Security: How Enterprises Are Managing Endpoint Security Threats

New on The Edge: RASP 101: Staying Safe With Runtime Application Self-Protection

While attackers historically have targeted businesses purely for financial gain, he says they're now paying closer attention to which parts of the businesses they can access and the type of data they can steal. If a victim refuses to pay up, they can threaten to publish the information. The result is an evolution from "your business is not available" to a cyber extortion indicent.

This is a major fear at the executive level, D'sa continues, because there are more ramifications when sensitive corporate data goes public. It's prompting more conversation in the C-suite.

Driving executive concerns is a preference for big game hunting, adds Sherif El-Nabawi, vice president of sales engineering at CrowdStrike. Attackers are focusing on specific individuals versus broad campaigns, and they are "very successful" in doing so. They also request larger ransoms: Some groups, with bitcoin conversions, reached gains of $100 million. 

"Ransomware-as-a-service has accelerated this," he says of the trend. "It meant there are more groups going into this field very quickly. It meant the escalation and speed of the actual attacks, and the success rates, are higher. With ransomware-as-a-service, attackers don't have to do the full attack life cycle. They can stick with what they're good at and outsource other components.

Attackers targeting Asian organizations tend to have a longer "dwell time" compared with other regions, giving them a larger window to navigate the environment and achieve their goals, adds D'sa, who says while it's trending downward, "dwell time in Asia is definitely a lot higher than what we see across the rest of the world."

In one case, he says, attackers targeting a business were able to spend 40 days getting from the satellite office into its main data center, identify a backup server, and run an entire ransomware operation so they had maximum benefit. Longer dwell time enabled a much larger impact.

[Sherif El-Nabawi and Steven D'sa will share more about online attacks targeting Asia-Pacific organizations in an upcoming Black Hat Asia panel, "Trends in Online Attacks," next week.]

Both experts agree nation-state groups based out of China pose a major threat to the region. While these attackers typically dominate threats against telecommunications, El-Nabawi says threat intelligence indicates they have also targeted food and beverage, healthcare, manufacturing, and pharmaceuticals, in addition to telecommunications and tech companies.

When it comes to defending against these attacks, however, Asian businesses have work to do.

"The difference in the adoption of cybersecurity defenses [and] the overall availability of resources in terms of dealing with these threats -- Asia is still playing catch-up," says D'sa. He advises firms to focus more on planning out their remediation following an incident. Security teams in the region, often under executive pressure, tend to rush the process and lack visibility as a result.

"We see a lot of retargeting and re-compromise in Asia because of that," he adds. 

El-Nabawi sees the same inclination to close and quickly remediate, as well as the same tendency to limit the scope of a breach to a single business unit or geography.

"The reality is the threat actor does not know that. He looks at your network as one, and he's targeting globally," he explains. "One of the key reasons we see attackers targeting again is they can come from another part of the network that hasn't been secured or hasn't been assessed."

Multiple talks at the virtual Black Hat Asia will discuss the threats organizations face, the challenges they experience in mitigating attacks, and best practices for defense. In the keynote "Complexity Killed Security," Graz University of Technology infosec professor Daniel Gruss will discuss the unforeseen additional complexities in security and the challenges these present to organizations. 

In a talk entitled "Adversary Detection Pipelines: Finally Making Your Threat Intel Useful," analyst Xena Olsen will discuss how businesses can derive greater value from threat intelligence feeds, explain the difficulties of attribution, and examine case studies of Adversary Detection Pipelines.

And for organizations fearing the worst, a panel on "Managing Data Breaches and Incident Response" will dive into processes that should be followed following a successful attack.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Overcoming the Challenge of Shorter Certificate Lifespans
Mike Cooper, Founder & CEO of Revocent,  10/15/2020
US Counterintelligence Director & Fmr. Europol Leader Talk Election Security
Kelly Sheridan, Staff Editor, Dark Reading,  10/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-3995
PUBLISHED: 2020-10-20
In VMware ESXi (6.7 before ESXi670-201908101-SG, 6.5 before ESXi650-202007101-SG), Workstation (15.x before 15.1.0), Fusion (11.x before 11.1.0), the VMCI host drivers used by VMware hypervisors contain a memory leak vulnerability. A malicious actor with access to a virtual machine may be able to tr...
CVE-2020-7363
PUBLISHED: 2020-10-20
User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of UCWeb's UC Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects UCWeb's UC Browser version 13.0.8 and prior versions.
CVE-2020-7364
PUBLISHED: 2020-10-20
User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of UCWeb's UC Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects UCWeb's UC Browser version 13.0.8 and prior versions.
CVE-2020-7369
PUBLISHED: 2020-10-20
User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of the Yandex Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects the Yandex Browser version 20.8.3 and prior versions, and was fixed in version ...
CVE-2020-7370
PUBLISHED: 2020-10-20
User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of Danyil Vasilenko's Bolt Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects the Bolt Browser version 1.4 and prior versions.