Research

Both threat actors and cybercriminals use the most advanced techniques to boost their attacks’ success rate, including hiding behind legitimate traffic. How can your local IT department catch them when they don’t rouse suspicion?

For many users, .com is the only domain that matters. But when cybercriminals start using .bit, a new kind of top-level domain (TLD) for malicious activities, people are bound to take notice.

The Chinese market economy is undoubtedly booming. These days, however, China does not only rank highly for economic performance; it also continues to grow as a major player in the underground market for cybercrime products and services.

Whether considered advanced persistent threats (APTs) or malware-based espionage attacks, successful and long-term compromises of high-value organizations and enterprises worldwide by a consistent set of campaigns cannot be ignored.

Once inside a network, targeted attacks can use it as a highway to further a campaign. By using network traffic, coupled with threat intelligence, enterprise response teams can monitor and stop attacks before their respective attackers get away with their goal

RATs or remote access Trojans—like the prominent Gh0st, PoisonIvy, and DRAT—have made it easier for attackers to stay hidden within a target network. A RAT's ability to disguise their network traffic as messaging app traffic makes it especially elusive.

Though phishing threats are typical on the Internet, the danger of spear-phishing attacks shouldn’t be downplayed. Sixty-five government entities have been exposed to spear-phishing—still the favored attack method because of its continued success in tricking

Targeted attack incidents from previous years prove that targeted campaigns don't always use the same attack methods. Diversifying defense measures such as log inspection, virtual patching, and the like can help minimize the risks they may face in 2013.

The Taidoor campaign primarily targeted government organizations located in Taiwan. Trend Micro Research was able to develop indicators of compromise useful in determining if an attack is underway in an enterprise.