Caught in the Net: Unraveling the Tangle of Old and New Threats

Messaging threats

As a means for important communications to and from an enterprise’s network, business email makes for an attractive platform for cybercriminals. Consequently, phishing and other social engineering schemes are among the top concerns for cybersecurity professionals, as unwanted emails designed and worded professionally can easily fool a recipient who regularly fields similar emails.  

In 2018, we saw an increase in the use of various forms of messaging threats. Most notably, we observed an 82-percent increase in blocked access to phishing URLs by unique client IP address compared to the previous year. Phishing traditionally arrives via email since email-based threats are much more platform-agnostic than other types of attacks that rely, for instance, on specific exploits.

Year-on-year comparison of blocked access to phishing URLs by unique client IP address (e.g., one machine that accessed a link three times was counted as one)

Recently, apart from emails, there have also been phishing attacks that use chat, SMS, and other communication modes. The increase in numbers as well as different versions of phishing attacks shows how cybercriminals are adapting to a changing landscape. More connected devices and a widening range of operating systems mean that exploiting one particular operating system will not be as profitable for cybercriminals as in the past. Consequently, they are turning to an old but still usually effective attack.

Another form of messaging attacks that picked up pace in 2018 was business email compromise (BEC). In a typical BEC attack, an attacker initiates or intercepts communications to con an enterprise employee who has the power to release or transfer funds.

While the overall number of these BEC attacks was low, a successful attempt could result in high financial losses for the target company. By contrast, phishing attacks were widely launched against a number of possible victims because duping even a low percentage of users would be profitable for attackers.

Critical vulnerabilities

The year in security began with the groundbreaking disclosure of Meltdown and Spectre, processor-level vulnerabilities that relied on flaws in the speculative execution of CPU instructions. These new classes of flaws affected different microprocessors and spawned new CPU attacks as well as a slew of mitigation troubles. And even by the end of the year, there was no straightforward solution for these micro-architectural weaknesses.

Another unfortunate first in 2018 was the discovery of a critical vulnerability in the open-source cloud orchestration software Kubernetes. Fortunately, this particular flaw was quickly patched.

Most vulnerabilities are found and then responsibly disclosed by security researchers and vendors so that they cannot be used in any widespread attacks. But disclosing a vulnerability to the public also means alerting threat actors to it, so creating a fix before information is released is vital. Threat actors actively abuse vulnerabilities to create operational exploits.

Recently, no widespread zero-day exploit attacks were identified, unlike in the past, when two or three major zero-day attacks would define a year. Rather, the attacks that were discovered in 2018 were of limited scope. Cybercriminals were also abusing vulnerabilities that had already been patched, banking on the assumption that many users did not speedily apply the available fixes, if at all. 

Notable attacks in 2018 involving exploits for known and patched vulnerabilities

Of the vulnerabilities found in 2018, a considerable percentage was for software used in industrial control systems (ICSs). And most of those vulnerabilities were in human-machine interface (HMI) software for ICSs and supervisory control and data acquisition (SCADA) environments. The HMI is the main hub for monitoring, managing, and implementing the states of different processes in facilities. Exploiting a critical HMI vulnerability could allow an attacker to affect the functionality of the physical components of an enterprise facility. 

Trend Micro Research

Machine Learning Solutions

• Ahead of the Curve: A Deeper Understanding of Network Threats Through Machine Learning
• Adversarial Sample Generation: Making Machine Learning Systems Robust for Security
• Uncovering Unknown Threats With Human-Readable Machine Learning

Connected Hospitals, Energy Providers, Water Companies

• Exposed and Vulnerable Critical Infrastructure: Water and Energy Industries
• The Fragility of Industrial IoT’s Data Backbone
• Securing Connected Hospitals: A Research on Exposed Medical Systems and Supply Chain Risks

Cybercriminal Investigations and Takedowns

• The Rise and Fall of Scan4You
• The Evolution of Cybercrime and Cyberdefense