text: Figure 2: Source: NETSCOUT

text:  with Emotet malware . Then the Emotet malware delivers the TrickBot Trojan, targeting and exploring sensitive information. If the information is found and the targeted environment/network is in the attacker’s list, Ryuk ransomware is delivered.

identifier: ENISA Threat Landscape 2020 - Botnet

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

title: ENISA Threat Landscape 2020 - Botnet

serie: rapporter

text: EN From January 2019 to April 2020

type: rubrik

text: Botnet

text: ENISA Threat Landscape

text: Overview

text: A botnet is a network of connected devices infected by bot malware. These devices are typically used by malicious actors to conduct  Distributed Denial of Service (DDoS) attacks . Operating in a peer-to-peer 1 2 (P2P) mode or from a Command and Control (C2) center, botnets are remotely controlled by a malicious actor to operate in a synchronised way to obtain a certain result. Technological advancements in distributed computing and automation have created an opportunity for malicious actors to explore new techniques and improve their tools and attack methods. Thanks to this, botnets operate in much more distributed and automated ways and are available from self-service and ready-to-use providers. Malicious bots, referred as ‘bad bots’, are not only constantly evolving but people’s skillsets and the bots’ level of development are becoming highly specialised in certain applications, such as defence-providers or even evasions techniques. From a different perspective, botnets provide a vector for cybercriminals to launch various operations from e-banking  5 fraud to ransomware , mining cryptocurrencies and DDoS attacks. __Findings 7,7_million IoT devices are connected to the Internet every day Of these, 1 in 20 is estimated to be behind a firewall or similar network security tools. 57%_increase in the number of Mirai variants detected during 2019 Although Mirai variants are known to use brute-force attempts predominantly for compromising IoT devices, there was an increase in both brute-force (51%) and web exploitation (87%) attempts during 2019. 300.000_notifications of Emotet botnet traffic observed during 2019 This accounted for over 100.000 more victim alerts than same period in 2018. Researchers believed that there was a 913% increase in the number Emotet samples having compared the second halve of 2018 and 2019. of new rival botnet activity is

text: associated with stealing credentials 17.602_ fully functional botnet C2 servers found in 2019 71,5% increase compared with 2018.

text: Kill chain

text: Reconnaissance Weaponisation Delivery Exploitation Step of Attack Workflow Width of Purpose Botnet Command & Actions on Installation Control Objectives The Cyber Kill Chain framework was developed by Lockheed Martin, adapted from a military concept related with the structure of an attack. To study a particular attack vector, use this kill-chain diagram to map each step of the process and reference the tools, techniques and procedures used by the attacker. MORE INFORMATION

text: Trends

text: _Bots are big money Bots are facilitating brute-force capabilities by luring victims into buying limited-edition items or items on promotional offers and subsequently reselling them at a higher price. This fact was identified by analysing a job posting in which the advertiser was looking for a software developer with experience of evading security defences, creating bots with evasion techniques (i.e. web scrapping, reCAPTCHA bypass, cookie generation, etc.) and willing to pay US$ 15.000 (ca. €12.750) for the right candidate. _The bricking Silexbot During June 2019, a security researcher analysed a new bot sample developed to disrupt the functionalities of insecure IoT devices. In other words, this bot was designed to use known/default credentials of IoT devices to log-in and subsequently kill the device by deleting network configurations and adding an IP tables’ rule to drop all connections. On top of the technical capabilities, an interesting point was the note left on the  malware sample. The threat actor apologises for their activity and explains their actions as a way of preventing mass exploitation of insecure ` IoT devices to build botnets for malicious purposes. _Echobot and its growing threat vector During June 2019, a security researcher identified an updated version of Echobot. In this analysis, the researcher observed an x86 compiled sample leading to attack vectors used by this Mirai variant in 26 different incidents. During August, another security researcher found an increase in Echobot, exploiting 50 different vulnerabilities including the ‘command 25, 26 injection over HTTP’ (CPAI-2016-0658 ). In December 2019, another team detected an enhanced version of Echobot including 71 exploits. The newly added exploits were targeting old and new vulnerabilities and had a significant added capability of targeting Industrial Control System (ICS) devices. This included companies and devices such as Mitsubishi, Citrix NetScaler app-delivery controls, Barracuda web application firewall and endpoint administration tools. _Necurs on the fall while Emotet rises again During January 2019, Necurs was observed moving into an amateur type of spam campaign, which made researchers think that the malicious actors behind it had a significant decrease in their skillset. In contrast, Emotet’s activity increased substantially since September 2019 and continued surging towards the end of 2019, dropping unique compiled binaries representing persistent delivery vector and communication mechanisms. An analysis revealed a sharp increase in the distribution of Emotet by e-mail.

text: Trends

text: _Retadup, the Botnet behind Monero- Mining has fallen Retadup was mostly active as the Monero-mining worm that developed polymorphic capabilities. It had infected Windows machines in Latin America. This bot had capabilities raging from mining to deploying custom code and downloaded files to the victims’ machines (it was also observed distributing STOP ransomware ). A security researcher started monitoring the Retadup activity in March 2019 and noticed that the C2 protocol was designed in a simple way. The team identified a flaw in the protocol that enabled them to remove infections from the victim by taking over the C2 server. The infrastructure for this malicious activity was identified as being mostly in France. The botnet was taken down with the collaboration of the National Gendarmerie (France) and around 850.000 computers were disinfected. _Mirai is dead, long live Mirai It might be because of the lack of skills and features in the original code that Mirai and its variants still dominate in the botnet families, and more than 20.000 unique samples were observed monthly during the first half of 2019. These variants use different techniques for compromising IoTs, from brute-forcing default hard-coded passwords to exploits. There is also a broad diversity of system architectures targeted by these variants according to two security researchers. More statistics on Emotet activity 7,18 presented in Figure 1. _The P2P Roboto botnet Roboto’s activity was first observed during August 2019 by a security research team as a P2P botnet program. The first sample captured was a suspicious ELF file. During October the research team identified another sample (ELF file) which turns out to be the downloader of the previous sample. Upon further analysis, the research team discovered that Roboto botnet can support seven function, namely reverse shell, self-deactivation, process and network information gathering, bot information gathering, executing URL specified files, DDoS attacks and running system attacks. Interestingly, it seems that a DDoS attack is not its main use case according to the researcher. Unlike other botnets, this bot was spreading by 28 11 exploiting the Webmin RCE vulnerability (CVE-2019-1507 ). _Mozi, another DHT based botnet Named after its propagation filename, Mozi has been identified as a brand new DHT based botnet observed by a security researcher in September 2019. An initial analysis of the sample conducted by another security researcher identified it as Gafgyt. However, that was because the sample partially reused the code from Gafgyt. This botnet spreads by using a handful of exploits and exploiting weak passwords for telnet. Analysis of its functionalities revealed that it could be capable of running DDoS attacks, information gathering, executing and updating sample/payload 29, 30 using a specified URL and executing commands.

text: Trends

text: __Statistics on Emotet activity Finding Statistic Total number of ASn detected: 5.430 Total number of unique IPs detected: 120.764 Total countries participating: 193 Total emails sent: 10.935.346 Total distribution URLs: 4.726 Distinct RCPTs targeted: 8.052.961 5 Figure 1: Source: Spamhaus “Technological advancements in distributed computing and automation have created an opportunity for malicious actors to explore new techniques and improve their tools and attack methods” in ETL 2020 1 1

text: Findings

text: _Statistics and other relevant numbers According to a security researcher, 7,7 million IoT devices are connected to the Internet every day and only 1 in every 20 is estimated to be behind a firewall or similar network security tool. This estimation reveals that IoT devices are still vulnerable and susceptible to exploitation by cybersecurity threats such as Mirai.  During the first half of 2019, botnet activity and hosting C2 servers increased substantially. This increase represented 7% of all botnet detections and 1,8% of C2s around the world. Financial services and their customers was the sector most often targeted.  Thailand was the top country in terms of hosting C2 servers while Malaysia came second followed by the Philippines, Singapore and Indonesia.  Based on Interpol research, the Andromeda botnet was the most dominant in terms of detection although it was dismantled in 2017. 34 35 36 37 Conficker came second followed by Necurs , Sality and Gozi . During 2019, the number of Mirai variants detected increased by more than 57% compared with 2018 as depicted in Figure 2. Although Mirai variants are known to use brute-force attempts predominantly for compromising IoT devices, during 2019 there was an increase in both brute-force (51%) and web exploitation (87%) attempts. __Mirai sample count 250,000 225,855 200,000 150,000 143,344 100,000 50,000 34,517 0 2017 2018 2019

text: Findings

text: _Statistics and other relevant numbers  During 2019, a security researcher observed nearly 300.000 more notifications of Emotet botnet traffic and over 100.000 more victim alerts compared with the same period in 2018. The researcher believes that there was a 913% increase in the number of Emotet samples 7,22 having compared the second halves of 2018 and 2019.  There was an increase in P2P botnet activity since Roboto and Mozi became active.  Linux based botnets were responsible for almost 97,4% of attacks.  The highest share of botnets were registered in the United States (58,33%) in Q4 2019. While this is an increase compared with Q3 2019 (47,55%), the total number of C2 servers almost halved. The United Kingdom was is in fourth place and jumped to second place with 14,29%, while China maintained the same position at 9.52%. The most significant decrease in C2 registered servers was in the Netherlands (from 45% to ~1%). For more information about botnet C2 servers distribution by country please consult Figure 3.  In 2019, LokiBot remained at the top of the list of credential stealing bots with an increase in the number of C2 activity by 74% compared with 2018. AZORult was in second position right behind LokiBot.  17.602 botnet C2 servers were live during 2019, representing a 71,5% increase compared with 2018. __Distribution of botnet C&C servers by country Other 5.95% United States 58.33% United Kingdom 14.29% China 9.52% Russia 3.57% Iran 2.38% Switzerland 1.19% Netherlands 1.19% Canada 1.19% Hong Kong 1.19% 0% 10% 20% 30% 40% 50% 60% 70% 8 Figure 3: Source: Kapersky

text: Attack vectors

text: _ The botnet attacks According to a security researcher, in 2019, nearly 60% of new rival botnet activity was associated with stealing credentials. As previously mentioned, LokiBot is the most active in this area. In addition to the credential-stealing activity, e-banking and financial fraud are other areas where botnet’s presence is vast. Emotet and TrickBot are prime examples of this activity with an updated model covering not only ebanking fraud but also pay-per-install (PPI). Moreover, Remote Access Trojans (RATs) were among the most used tools in botnets C2 activities. During 2018, most of these activities were associated with Adwind, but in 2019, its activity was reduced and replaced by NanoCore. Specific attack vectors were adopted in 2019. Botnets use various attack vectors to reach their objectives. Infected machines or zombie networks are created by exploiting common vulnerabilities with brute- 10,11,12 force and other common infection techniques. Subsequently, the botmaster is capable of providing a platform for different attacks including the widespread spamming and malware campaign, stealing and reusing credentials, crypto-mining and DDoS. Another example of an attack vector used in a botnet attack is the ‘Triple Threat’. In this technique, the targeted organisation is initially infected __Number of botnet C2 servers observed between 2014 and 2019 2019 17,602 2018 10,263 2017 9,500 2016 7,314 2015 8,480 2014 7,314 0 5,000 10,000 15,000 20,000 Source: Spamhaus

text: Mitigation

text: _ Proposed actions One key aspect of having a solid defence is the concept of knowing the environment. This will help to identify malicious activity within the traffic based on the possible baseline (i.e. behavioural detections) measured by a traffic monitoring tool. Considering that substantial botnet traffic is associated with DDoS activity, mitigation techniques for DDoS threat also apply.  Deploy border gateway protocol feeds with the capability to look for dTLDs (decentralised top-level domains) to block connections to IP addresses related to botnet C2 activity.  Understand and categorise vulnerabilities and implement a strong 15,16 patching and updating practice.  Restrict or block cryptocurrency mining pools and monitor the environment for required users.  Deploy challenge based capabilities for required websites to check the origin of traffic (i.e reCAPTCHA).  Deploy strong password and authentication (2FA) policies on publicfacing servers or infrastructure to avoid being a victim of weak password/authentication exploitation.  Deploy and configure network and application firewalls. “The threat landscape is becoming extremely difficult to map. Not only attackers are developing new techniques to evade security systems, but threats are growing in complexity and precision in targeted attacks.” in ETL 2020

text: References

text: 1. “Peer-to-peer (P2P).” Malwarebytes Labs https://blog.malwarebytes.com/glossary/peer-topeer/

type: stycke

text: 2. Monnappa K A. “Learning Malware Analysis.” June 2018. O’reilly. https://www.oreilly.com/library/view/learning-malware-analysis/9781788392501/17a1735d- 9583-4d86-9d1e-8b2735af5168.xhtml

text: 3. “ASEAN Cyberthreat Assessment 2020.” February 17, 2020. Interpol https://www.interpol.int/News-and-Events/News/2020/INTERPOL-report-highlights-keycyberthreats-in-Southeast-Asia

text: 4. “State of The Internet Security - DDoS and Application Attacks Report: Volume 5, Issue 1.”

text: 2019. Akamai. https://www.akamai.com/us/en/multimedia/documents/state-of-theinternet/state-of-the-internet-security-ddos-and-application-attacks-2019.pdf

text: 5. “Spamhaus Botnet Threat Report 2019.” January 28, 2020. Spamhaus. https://www.spamhaus.org/news/article/793/spamhaus-botnet-threat-report-2019

text: 6. “NETSCOUT Threat Intelligence Report: Powered by ATLAS - Findings from H1 2019.” 2019.

text: 7. “NETSCOUT Threat Intelligence Report - With key findings from the 15th Annual Worldwide Infrastructure Security Report (WISR) - Findings from H2 2019.” 2019. NETSCOUT. https://www.netscout.com/threatreport

text: 8. Oleg Kupreev, Ekaterina Badovskaya, Alexander Gutnikov. “DDoS attacks in Q4 2019.” February 13, 2020. Kaspersky. https://securelist.com/ddos-report-q4-2019/96154/

text: 9. Alina Dettmer. “What is Pay Per Install.?” October 26, 2017. Aye Studios. https://www.ayetstudios.com/blog/mobile-advertising/mobile-campaign-types/pay-per-install

text: 10. Larry Cashdollar. “Latest Echobot: 26 Infection Vectors.” June 13, 2019. Akamai. https://blogs.akamai.com/sitr/2019/06/latest-echobot-26-infection-vectors.html

text: 11. “The awaiting Roboto Botnet.” November 20, 2019. Netlab. https://blog.netlab.360.com/theawaiting-roboto-botnet-en/

text: 12. Asher Davila. “Home & Small Office Wireless Routers Exploited to Attack Gaming Servers.” October 31, 2019. Paloalto. https://unit42.paloaltonetworks.com/home-small-office-wirelessrouters-exploited-to-attack-gaming-servers/

text: 13. “Triple Threat: Emotet deploys Trickbot to steal data & spread Ryuk.” April 2, 2019. Cybereason. https://www.cybereason.com/blog/triple-threat-emotet-deploys-trickbot-to-stealdata-spread-ryuk-ransomware

text: 14. “Bots.” Imperva. https://www.imperva.com/learn/application-security/what-are-bots/

text: 15. Rebecca Carter. “Bot Mitigation Best Practices.” October 19, 2018. DYN. https://dyn.com/blog/bot-mitigation-best-practices/

text: 16. “What is a Botnet?” Veracode. https://www.veracode.com/security/botnet

text: 17. “SIRT Advisory: Silexbot bricking systems with known default login credentials”. June 26, 2019. Akamai.

text: 18. “Mirai Botnet Continues to Plague IoT Space”. September 10, 2019. Reversing Labs. https://blog.reversinglabs.com/blog/mirai-botnet-continues-to-plague-iot-space

text: 19. The Shadowserver Foundation. https://www.shadowserver.org/

text: 20. “As Necurs Botnet Falls from Grace, Emotet Rises” January 27, 2020. Threat Post. https://threatpost.com/as-necurs-botnet-falls-from-grace-emotet-rises/152236/

text: 21. “Mirai malware, attacks Home Routers”. December 14, 2016. ENISA. https://www.enisa.europa.eu/publications/info-notes/mirai-malware-attacks-home-routers

text: 22. “Estimating Emotet’s size and reach”. December 12, 2019. SPAMHAUS. https://www.spamhaus.org/news/article/791/estimating-emotets-size-%20-and-reach

text: 23. “Monero-Mining RETADUP Worm Goes Polymorphic, Gets an AutoHotKey Variant”. April 23,

text: 2018. Trend Micro. https://blog.trendmicro.com/trendlabs-security-intelligence/monero-miningretadup-worm-goes-polymorphic-gets-an-autohotkey-variant/

text: 24. “Meet Stop Ransomware: The Most Active Ransomware Nobody Talks About”. September 20,

text: 2019. Bleeping Computer. https://www.bleepingcomputer.com/news/security/meet-stopransomware-the-most-active-ransomware-nobody-talks-about/

text: 25. “Command Injection Over HTTP”. July 26, 2016. Check Point. https://www.checkpoint.com/defense/advisories/public/2016/cpai-2016-0658.html/

text: 26. “August 2019’s Most Wanted Malware: Echobot Launches Widespread Attack Against IoT Devices”. August 2019. Check Point. https://blog.checkpoint.com/2019/09/12/august-2019smost-wanted-malware-echobot-launches-widespread-attack-against-iot-devices/

text: 27. “Echobot Malware Now up to 71 Exploits, Targeting SCADA”. December 18, 2019. F5 Labs. https://www.f5.com/labs/articles/threat-intelligence/echobot-malware-now-up-to-71-exploits-targeting-scada

text: 28. “CVE-2019-15107 Detail”. NIST. https://nvd.nist.gov/vuln/detail/CVE-2019-15107

text: 29. “What is a distributed hash table?”. EDPresso. https://www.educative.io/edpresso/what-is-adistributed-hash-table

text: 30. “A Look into the Gafgyt Botnet Trends from the Communication Traffic Log”. July 23, 2019. https://nsfocusglobal.com/look-gafgyt-botnet-trends-communication-traffic-log/

text: 32. "ASEAN Cyberthreat Assessment 2020, Key Insights From The ASEAN Cybercrime Operations Desk" Interpol, 2020

text: 33. “International team takes down virus-spewing Andromeda botnet”. December 5, 2017. The Register. https://www.theregister.com/2017/12/05/international_team_takes_down_virusspewing_androm eda_botnet/

text: 34. “The odd, 8-year legacy of the Conficker worm”. November 21, 2016. WeLiveSecurity. https://www.welivesecurity.com/2016/11/21/odd-8-year-legacy-conficker-worm/

text: 35. “The Necurs Botnet: A Pandora’s Box of Malicious Spam”. April 24, 2017. https://securityintelligence.com/the-necurs-botnet-a-pandoras-box-of-malicious-spam/

text: 36. “WhitePaper: Sality: Story of a Peer to-Peer Viral Network“. June 10, 2011. Broadcom.

text: 37. “Botnet C&C: Gozi”. FortiGuard Labs. https://fortiguard.com/encyclopedia/botnet/7630489 38. Virustototal. https://www.virustotal.com

text: 39. “Spamhaus Botnet Threat Report 2019” 2020 . Spamhaus. https://www.spamhaus.org/news/article/793/spamhaus-botnet-threat-report-2019

text: Related

text: ENISA Threat Landscape Report The year in review A summary on the cybersecurity trends for the period between January 2019 and April 2020. READ THE REPORT ENISA Threat Landscape Report List of Top 15 Threats ENISAs’ list of the top 15 threats of the period between January 2019 and April READ THE REPORT 2020. ENISA Threat Landscape Report Research topics Recommendations on research topics from various quadrants in cybersecurity READ THE REPORT and cyber threat intelligence. ENISA Threat Landscape Report Sectoral and thematic threat analysis Contextualised threat analysis between January 2019 and April 2020. READ THE REPORT ENISA Threat Landscape Report Emerging trends Main trends in Cybersecurity observed READ THE REPORT between January 2019 and April 2020. ENISA Threat Landscape Report Cyber Threat Intelligence overview The current state of play of cyber threat intelligence in the EU. READ THE REPORT

text: About

text: _ The agency The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found at www.enisa.europa.eu. Contributors Christos Douligeris, Omid Raghimi, Marco Barros Lourenço (ENISA), Louis Marinos (ENISA) and all members of the ENISA CTI Stakeholders Group: Andreas Sfakianakis, Christian Doerr, Jart Armin, Marco Riccardi, Mees Wim, Neil Thaker, Pasquale Stirparo, Paul Samwel, Pierluigi Paganini, Shin Adachi, Stavros Lingris (CERT EU) and Thomas Hemker. Editors Marco Barros Lourenço (ENISA) and Louis Marinos (ENISA). Contact For queries on this paper, please use enisa.threat.information@enisa.europa.eu. For media enquiries about this paper, please use press@enisa.europa.eu. Legal notice Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. Copyright Notice © European Union Agency for Cybersecurity (ENISA), 2020 Reproduction is authorised provided the source is acknowledged. Copyright for the image on the cover: © Wedia. For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders. ISBN: 978-92-9204-354-4 DOI: 10.2824/552242 Vasilissis Sofias Str 1, Maroussi 151 24, Attiki, Greece Tel: +30 28 14 40 9711 info@enisa.europa.eu www.enisa.europa.eu All rights reserved. Copyright ENISA 2020. https://www.enisa.europa.eu

type: vagledning

utgivare: enisa


text: Figure 1: Top cryptomining malware globally . Source: Check Point

text: 32% of the exchanges traded privacy coins.

text: Figure 2: Most target countries by cryptojacking. Source: Trend Micro

text: Browserbased mining

text: Figure 3: How much can a coin-mining botnet make in 30 days? Source: Broadcom

identifier: ENISA Threat Landscape 2020 - Cryptojacking

text: EN From January 2019 to April 2020

text: Cryptojacking

text: ENISA Threat Landscape

text: Overview

text: Cryptojacking (also known as cryptomining) is the unauthorized use of a device’s resources to mine cryptocurrencies. Targets include any connected device, such as computers and mobile phones; however, cybercriminals have been increasingly targeting cloud infrastructures. This type of attack has not attracted much attention from law enforcement agencies and its abuse is rarely reported , mainly because of its relatively few negative consequences. Nevertheless, organisations may notice higher IT costs, degraded computer components, increased electricity consumption and reduced employee productivity caused by slower workstations. 3% 13% Other 18% Jsecoin XMRig RubyMiner 22% Cryptoloot 21% Coinhive WannaMine 2% 21% __Findings 64,1_million cryptojacking hits by the end of 2019 78%_decrease in cryptojacking activities in the second half of 2019 compared with the first half Activities grew by 9% in the first half of 2019 compared with the 4 ,5 previous 6 months of 2018. 65%_of the 120 most popular exchanges in Q3 2019 had weak or porous know your costumer (KYC) processes 39,3%_of 2019 crypto mining infections targeted Japan. 20,8% of the crypto mining infections targeted India and 14,2% Taiwan, Figure 1 depicts the five countries with the most detected cryptocurrency miner malware infection attempts for 2018 and 7 2019. 13%_is attributed to trojan.Win32.Miner.bbb During the period November 2018 to October 2019, the next most active miners were Trojan.Win32.Miner.ays (11,35%), 6 Trojan.JS.Miner.m (11,12%).

text: Kill chain

text: Cryptojacking Reconnaissance Weaponisation Delivery Exploitation Step of Attack Workflow Width of Purpose Cryptojacking Command & Actions on Installation Control Objectives The Cyber Kill Chain framework was developed by Lockheed Martin, adapted from a military concept related with the structure of an attack. To study a particular attack vector, use this kill-chain diagram to map each step of the process and reference the tools, techniques and procedures used by the attacker. MORE INFORMATION

text: Trends

text: _Popular cryptomining service Coinhive closed down Coinhive started in September 2017 and advertised itself as an alternative revenue stream for web developers instead of banner advertisements. It used JavaScript libraries, which could be installed on websites, and the visitor’s processing power to legitimately mine cryptocurrency. Until its closure, in March 2019, it had been highly abused by threat actors who injected code into hacked websites to mine the Monero cryptocurrency and divert funds to their own pockets. After its closure, the volume of web-based cryptojacking hits dropped by 78% during the second half of 2019. As a result of this decrease, cybercriminals begun focusing on 9 1 higher value targets, such as powerful servers and cloud infrastructures. Coinhive’s place at the top has since been taken by Jsecoin (22%), XMRig (21%) and Cryptoloot (21%). The distribution of top cryptomining malware globally is presented in Figure 1. _More attacks on cloud infrastructures An increasing trend was visible in the first half of 2019, regarding incidents 15,25 of cryptocurrency-mining attacks on the cloud. Cloud environments usually employ mechanisms that tailor resources on-demand and are therefore lucrative targets for running mining software. However, this comes at the expense of website owners, who in turn need to pay higher bills for exceeding quotas. In the first half of 2019, vulnerabilities in cloud container software increased by 46% compared with the same period in 2018. Attackers have been successful in exploiting application programming interfaces (APIs) and container management platforms in order to install malicious images (e.g. Docker and Kubernetes) and mine cryptocurrencies. __Incidents April 2019_Cryptojacking campaign dubbed Beapy, exploited the EternalBlue vulnerability and affected enterprises in China May 2019_Monero-mining malware PCASTLE mostly targeted China-based systems, by employing fileless arrival techniques Over 50.000 servers belonging to companies in the healthcare, telecommunications, media and IT sectors were found to be 20 infected by malware mining the TurtleCoin (TRTL) cryptocurrency. A new malware family named BlackSquid, utilized eight known exploits including EternalBlue and DoublePulsar and subsequently spread to web servers across Thailand and the United States so as 17,21 to deliver Monero mining scripts. August 2019_Cryptojacking malware found in 11 RubyGem language repositories, exposing thousands of users to cryptomining code

text: Trends

text: _Shift towards file-based cryptomining In 2019, a decline in browser-based cryptojacking in favour of file-based cryptomining was noticed. File-based cryptomining attacks spread through malware and made use of pre-existing exploits on unpatched operating systems such as EternalBlue and other high-risk vulnerabilities. Factors contributing to this shift were the closure of the popular webbased mining provider Coinhive and the decline in cryptocurrency values. Another factor is that file-based cryptomining has always been more efficient than web-based mining, being 25 times more profitable. Threat actors adapted their malware with additional tools, to extract sensitive information from the victim’s computer. _Worldwide cryptojacking attacks are decreasing In 2019, a downwards trend , in cryptojacking attacks was noticed, mainly due to the closure of Coinhive , the coordinated efforts of law enforcement agencies, and the depreciation of the Monero cryptocurrency . However, as cryptojacking attacks have been known to follow cryptocurrency values, a service similar to Coinhive may emerge, and fuel a new spike. Early statistics for 2020, show a 30% increase yearon-year in March. _Monero remained the cryptocurrency of choice Similar to previous trends, Monero (XMR) was the cryptocurrency of choice for 2019 cryptojacking activities. The reason is two-fold; first, Monero is focused on privacy and anonymity and, therefore, the transactions cannot be traced. Second, the Proof-of-Work algorithm is designed to make mining viable with a standard CPU as opposed to specialized hardware. In Q3 2019, 32% of exchanges traded privacy coins such as Monero. However, in anticipation of new anti-money laundering regulations, many exchanges opted to delist privacy coins. _Most targeted countries

text: Attack Vectors

text: _Techniques Cyber criminals used the following techniques to run or deliver cryptominers:  by incorporating cryptojacking capabilities in existing malware;  by compromising websites;  by persistent drive-by attacks;  using social networks;  using mobile apps and app stores;  using exploit kits;  using advertising networks and malvertising;  using removable media;  and using wormable cryptominers. $30K File-based mining

text: _Proposed actions  Monitor battery usage on users’ devices and, in the case of suspicious spikes in CPU usage, scan for the presence of file-based miners.  Implement content filtering to filter out unwanted attachments, e-mails with malicious content and spam.  Implement filtering of the stratum mining protocol as well as blacklisting the IP addresses and domains of popular mining pools.  Install end-point protection by means of anti-virus programs or cryptominer blocking browser plug-ins.  Conduct regular security audits to detect network anomalies.  Implement robust vulnerability and patch management.  Use whitelisting to prevent unknown executables from being executed at the endpoints.  Invest in raising users’ awareness of crytojacking, especially with regard to secure browsing behaviour.  Implement patches and fixes against well-known exploits, such as Eternal Blue, on less obvious targets, such as queue management systems, POS terminals, and even vending machines.  Monitor and blacklist common cryptomining executables.

text: References

text: 1. Sergiu Gatlan. “Cryptominers Still Top Threat In March Despite Coinhive Demise.” April 9, 2019. Bleeping Computer. https://www.bleepingcomputer.com/news/security/cryptominers-still-topthreat-in-march-despite-coinhive-demise/

text: 2. “Internet Organised Crime Threat Assessment (IOCTA).” 2019. EUROPOL. https://www.europol.europa.eu/iocta-report

text: 3. “Beapy: Cryptojacking Worm Hits Enterprises in China.” 24 April, 2019. BROADCOM. https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/beapy-cryptojackingworm-china

text: 4. Bill Conner. “SONICWALL Cyber Threat Report.” 2020. SONICWALL https://www.sonicwall.com/resources/2020-cyber-threat-report-pdf/

text: 5. Yessi Bello Perez. “Unsuspecting victims were cryptojacked 52.7 million times in the first half of 2019.” July 24, 2019. TheNextWeb – HARD FORK. https://thenextweb.com/hardfork/2019/07/24/cryptojacking-cryptocurrency-million-hits-firsthalf-2019/

text: 6. Ben Noble. “A Third of Cryptocurrency Exchanges Still Host Privacy Coins Despite Fears of Impending FATF Travel Rule.” November 27, 2019. CIPHERTRACE https://ciphertrace.com/ciphertrace-q3-2019-caml-press-release/

text: 7. ”Defending Systems Against Cryptocurrency Miner Malware.” October 28, 2019. Trend Micro. https://www.trendmicro.com/vinfo/be/security/news/cybercrime-and-digital-threats/defendingsystems-against-cryptocurrency-miner-malware

text: 8. “Kaspersky Security Bulletin ’19 Statistics.” 2009. Kaspersky. https://go.kaspersky.com/rs/802- IJN-240/images/KSB_2019_Statistics_EN.pdf

text: 9. “CYBER SECURITY REPORT.” 2020. Check Point Research cp<r>. https://www.checkpoint.com/downloads/resources/cyber-security-report-2020.pdf

text: 10. Ionut Ilascu. “EternalBlue Exploit Serves Beapy Cryptojacking Campaign.” April 25, 2019. Bleeping Computer. https://www.bleepingcomputer.com/news/security/eternalblue-exploitserves-beapy-cryptojacking-campaign/

text: 11. “New mining worm PsMiner uses multiple high-risk vulnerabilities to spread.” March 12, 2019. 360 Total Security. https://blog.360totalsecurity.com/en/new-mining-worm-psminer-usesmultiple-high-risk-vulnerabilities-to-spread/

text: 12. Dan Thorp-Lancaster. “New drive-by cryptocurrency mining scheme persists after you exit your browser window.” November 9, 2017. Windows Central. https://www.windowscentral.com/new-drive-cryptocurrency-mining-scheme-persists-even-afteryou-exit-your-browser-window

text: 13. Dr. Michaeal McGuire. “Social Media Platforms and the Cybercrime Economy.” 2019. Bromium. https://www.bromium.com/wp-content/uploads/2019/02/Bromium-Web-of-Profit- Social-Platforms-Report.pdf

text: 14. Axelle Apvrille. “Abusing cryptocurrencies on Android smartphones.” 2019. Fortinet. https://fortinetweb.s3.amazonaws.com/fortiguard/research/currency-insomnihack19.pdf

text: 15. “2019 Midyear Security Roundup Evasive Treats Pervasive Effects.” 2019. TrendMicro https://documents.trendmicro.com/assets/rpt/rpt-evasive-threats-pervasive-effects.pdf

text: 16. Margi Murphy. “YouTube shuts down hidden cryptojacking adverts.” January 29, 2018. The Telegraph https://www.telegraph.co.uk/technology/2018/01/29/youtube-shuts-hidden-cryptojacking-adverts/

text: 17. Matthew Beedham. “New cryptocurrency mining malware is spreading across Thailand and the US.” June 4, 2019. TheNextWeb – HARD FORK. https://thenextweb.com/hardfork/2019/06/04/security-crypto-jacking-mining-malware/

text: 18. Sean Lyngaas. “BlueKeep is back. For now, attackers are just using it for cryptomining.” November 4, 2019. CyberScoop. https://www.cyberscoop.com/bluekeep-exploited-cryptomining/

text: 19. Janus Agcaoili. “Monero-Mining Malware PCASTLE Zeroes Back In on China, Now Uses Multilayered Fileless Arrival Techniques.” June 5, 2019. Trend Micro. https://blog.trendmicro.com/trendlabs-security-intelligence/monero-mining-malware-pcastlezeroes-back-in-on-china-now-uses-multilayered-fileless-arrival-techniques/

text: 20. Marie Huillet. “Researchers Say 50,000 Servers Worldwide Infected With Privacy Coin Cryptojacking Malware.” May 29, 2019. Cointelegraph. https://cointelegraph.com/news/researchers-say-50-000-servers-worldwide-infected-withprivacy-coin-cryptojacking-malware

text: 21. Johnlery Triunfante, Mark Vicente. “BlackSquid Slithers Into Servers and Drives With 8 Notorious Exploits to Drop XMRig Miner.” August 27, 2019. Trend Micro. https://blog.trendmicro.com/trendlabs-security-intelligence/blacksquid-slithers-into-servers-anddrives-with-8-notorious-exploits-to-drop-xmrig-miner/

text: 22. “Malicious cryptojacking code found in 11 Ruby libraries.” August 2, 2019, Decrypt. https://decrypt.co/8602/malicious-cryptjacking-code-found-in-11-ruby-libraries

text: 23. Brook Chelmo. “Cryptojacking in 2019: Cryptocurrency Value Keeping Attack Vector in Play .” August 6, 2019. SonicWall. https://blog.sonicwall.com/en-us/2019/08/cryptojacking-in-2019cryptocurrency-value-keeping-attack-vector-in-play/

text: 24. Catalin Cimpanu. “Coinhive cryptojacking service to shut down in March 2019”. February 27,

text: 2019. ZD Net. https://www.zdnet.com/article/coinhive-cryptojacking-service-to-shut-down-inmarch-2019/

text: 25. Tom Hegel. “Making it Rain - Cryptocurrency Mining Attacks in the Cloud”. March 14, 2019. AT&T Business. https://cybersecurity.att.com/blogs/labs-research/making-it-rain-cryptocurrencymining-attacks-in-the-cloud/

text: 26. “How a Prominent Cryptomining Botnet is Paving the Way for a Lucrative and Illicit Revenue Model”. August 2019. Carbon Black. https://cdn.www.carbonblack.com/wpcontent/uploads/2019/08/Carbon-Black-Access-Mining.pdf

text: 27. “Cryptojacking Attacks: Who’s Mining on Your Coin?”. April 5, 2019. Security Intelligence. https://securityintelligence.com/cryptojacking-attacks-whos-mining-on-your-coin/

text: 28. “Malware Creates Cryptominer Botnet Using EternalBlue and Mimikatz’. April 12, 2019. Bleeping Computer. https://www.bleepingcomputer.com/news/security/malware-createscryptominer-botnet-using-eternalblue-and-mimikatz/

text: Related

text: ENISA Threat Landscape Report The year in review A summary on the cybersecurity trends for the period between January 2019 and April 2020. READ THE REPORT ENISA Threat Landscape Report List of Top 15 Threats ENISAs’ list of the top 15 threats of the period between January 2019 and April READ THE REPORT 2020. ENISA Threat Landscape Report Research topics Recommendations on research topics from various quadrants in cybersecurity READ THE REPORT and cyber threat intelligence. ENISA Threat Landscape Report Sectoral and thematic threat analysis Contextualised threat analysis between January 2019 and April 2020. READ THE REPORT ENISA Threat Landscape Report Emerging trends Main trends in Cybersecurity observed READ THE REPORT between January 2019 and April 2020. ENISA Threat Landscape Report Cyber Threat Intelligence Overview The current state of play of cyber threat intelligence in the EU. READ THE REPORT

text: About

text: Regulation (EU) No 526/2013


identifier: ENISA Threat Landscape 2020 - Cyber espionage

text: From January 2019 to April 2020

text: Cyber espionage

text: ENISA Threat Landscape

text: Overview

text: Cyber espionage is considered both a threat and a motive in the cybersecurity playbook. It is defined as ‘the use of computer networks to gain illicit access to confidential information, typically that held by a government or other organisation’. In 2019, many reports revealed that global organisations consider cyber espionage (or nation-state-sponsored espionage) a growing threat affecting industrial sectors, as well as critical and strategic infrastructures across the world, including government ministries, railways, telecommunication providers, energy companies, hospitals and banks. Cyber espionage focuses on driving geopolitics, and on stealing state and trade secrets, intellectual property rights and proprietary information in strategic fields. It also mobilises actors from the economy, industry and foreign intelligence services, as well as actors who work on their behalf. In a recent report, threat intelligence analysts were not surprised to learn that 71% of organisations are treating cyber espionage and other threats as a ‘black box’ and are still learning about them. In 2019, the number of nation-state-sponsored cyberattacks targeting the economy increased and it is likely to continue this way. In detail, nation-state-sponsored and other adversary-driven attacks on the Industrial Internet of Things (IIoT) are increasing in the utilities, oil and natural gas (ONG), and manufacturing sectors. Furthermore, cyberattacks conducted by advanced persistent threat (APT) groups indicate that financial attacks are often motivated by espionage. Using tactics, techniques and procedures (TTPs) akin to those of their espionage counterparts, groups such as the Cobalt Group, Carbanak and FIN7 have allegedly been targeting large financial institutions and restaurant chains successfully.  The European Parliament’s Committee of Foreign Affairs called upon Member States to establish a cyber-defence unit and to work together on their common defence. It stated that ‘the Union’s strategic environment has been deteriorating … in order to face the multiple challenges that directly or indirectly affect the security of its Member States and its citizens; whereas issues that affect the security of EU citizens include: armed conflicts immediately to the east and south of the European continent and fragile states; terrorism – and in particular Jihadism –, cyberattacks and disinformation campaigns; foreign interference in European political and electoral processes’.  Threat actors motivated by financial, political, or ideological gain will increasingly focus attacks on supplier networks with weak cybersecurity programs. Cyber espionage adversaries have slowly shifted their attack patterns to exploiting third- and fourth-party supply chain partners. Data breaches motivated Malicious actors connected by cyber espionage with nation-states

text: 20% 38%

text: Incidents motived by Cyber espionage incidents cyber espionage involving phishing

text: 11,2% 63%

text: Incidents

text:  South Korean’s Ministry of National Defence announced that unknown hackers had compromised computer systems at the ministry’s procurement office.  The United States Department of Justice announced a foreign statesponsored operation with a botnet meant to disrupt by targeting companies in the media, aerospace, financial, and critical infrastructure sectors.  The Norwegian software firm Visma revealed that it had been targeted by hackers who were attempting to steal trade secrets from the firm’s clients.  Individuals were caught in the early stages of gaining access to computer systems of several political parties and of the Australian Federal Parliament.  European aerospace company Airbus revealed that it was targeted by alleged nation-state sponsored hackers who stole personal and IT identification information of many employees.  Following an attack on Indian military forces in Kashmir, Pakistani hackers targeted almost 100 Indian government websites and critical systems.  Indonesia’s National Election Commission reported that Chinese and Russian individuals had probed the voters’ database ahead of presidential and legislative elections in the country.  Foreign hackers targeted several European government agencies ahead of EU elections in May.  The Australian Signal Directorate revealed that it had conducted cyberattacks against ISIS in the Middle East.  The Finish police probed a DoS attack against the web service used to publish the vote tallies from Finland’s elections.  Amnesty International’s Hong Kong Office announced that it had been the victim of an cyberattack.  The Israeli Defence Forces launched an airstrike on the Hamas after they unsuccessfully attempted to hack Israeli targets.  An Iranian network of websites and accounts was allegedly used to spread out false information about United Sates, Israel and Saudi Arabia.  Croatian government agencies were targeted in a series of attacks by unidentified state-sponsored hackers. The malware payloads were Empire backdoor and SilentTrinity, neither of which had been seen before.  Libya arrested two men who were accused of working with a Russian 27 ‘troll farm’ to influence the elections in several African countries.  Several major German industrial firms including BASF, Siemens, and Henkel announced that they had been the victim of a state-sponsored hacking campaign.  A state-sponsored group allegedly conducted a series of cyberattacks against Egyptian journalists, academics, lawyers, human rights activists, and politicians.  A state-sponsored hacking group targeted diplomats and high-profile Russian speaking users in Eastern Europe using malware dubbed Attor.  An Israeli cybersecurity firm was found to have sold spyware used to target senior government and military officials in at least 20 countries by exploiting a vulnerability in WhatsApp.  A 7 year campaign by an unidentified Spanish-language espionage group was revealed to have resulted in the theft of sensitive mapping files from senior officials in the Venezuelan Army.  A state-sponsored cyberespionage group allegedly conducted a phishing campaign targeting Chinese government agencies and stateowned enterprises for information related to economic trade, defence issues, and foreign relations.  The Czech Foreign Ministry fell victim to a cyberattack by an unspecified foreign state.  A non-state actor targeted the British Labour party with a major DDoS attack that temporarily took the party’s computer systems offline ahead of the national elections’.

text: Incidents

text: _ The General Electric case Xiaoqing Zheng, an American citizen of Chinese descent, was accused of spying against General Electric (GE). Mr. Zheng allegedly stole GE’s turbine technology secrets and delivered them to a Chinese business man who allegedly, delivered them to a Chinese officials. Mr Zheng worked for GE between 2008 and 2018. The United Sates justice department accused the two men of stealing information to advance their own business interests in two turbine research and development companies - Liaoning Tianyi Aviation Technology Co Ltd and Nanjing Tianyi Avi Tech Co Ltd. The modus operandi of this inside threat actor included:  copying secrets into a USB drive until GE blocked the use of these devices;  encrypting the secrets and use steganography to hide data files in the binary code of digital photo files;  plugging an iPhone to the work desktop computer to copy the image;  sending the files to his personal e-mail address. _ Mitigation measures Because of the comprehensive nature of this threat, several of the mitigation measures recommended for other threats in this report could be employed as part of the following baseline mitigation controls :  Identify mission critical roles in the organisation and estimate their exposure to espionage risks. Evaluate such risks based on business information (i.e. business intelligence).  Create security policies that accommodate human resource, business and operational security controls to cater for risk mitigation. These should include rules and practices for awareness raising, corporate governance and security operations.  Establish corporate practices to communicate, train staff in the rules developed.  Develop an evaluation criteria (KPIs) to benchmark the operation and adapt it to upcoming changes.  Create a Whitelist for critical application services depending on the risk level assessed.  Assess vulnerabilities and patch the software regularly, especially for systems that are on the perimeter.  Implement the need-to-know principle for defining access rights and establish controls to monitor misuse of privileged profiles.  Establish content filtering for all inbound and outbound channels (e.g. email, web, network traffic).

text: References

text: 1. “Cyber Threatscape Report. 2019.” IDefense - Accenture. https://www.accenture.com/_acnmedia/pdf-107/accenture-security-cyber.pdf

text: 2. “Data Breach Investigations Report 2020” DBR & Verizon. https://enterprise.verizon.com/resources/reports/2019-data-breach-investigations-reportemea.pdf

text: 3. Catalin Cimpanu.“Hackers breach and steal data from South Korea's Defense Ministry” January 16, 2019. ZDNet. https://www.zdnet.com/article/hackers-breach-and-steal-data-from-southkoreas-defense-ministry/

text: 4. Jack Stubbs.“China hacked Norway's Visma to steal client secrets: investigators” February 6, 2019. Reuters. https://www.reuters.com/article/us-china-cyber-norway-visma/china-hacked-norwaysvisma-to-steal-client-secrets-investigators-idUSKCN1PV141

text: 5. Kate Fazzini. “In India-Pakistan conflict, there’s a long-simmering online war, and some very good hackers on both sides”. February 28, 2019. CNBC . ttps://www.cnbc.com/2019/02/27/indiapakistan-online-war-includes-hacks-social-media.html

text: 6. Kati Pohjanpalo. “Finland Detects Cyber Attack on Online Election-Results Service”. April 10, 2019. Bloomberg. https://www.bloomberg.com/news/articles/2019-04-10/finland-detects-cyber-attack-on-onlineelection-results-service

text: 7. Lily Hay Newman “What Israel's Strike on Hamas Hackers Means For Cyberwar” June 5, 2019. Wired. https://www.wired.com/story/israel-hamas-cyberattack-air-strike-cyberwar/ 8.”Egypt Is Using Apps to Track and Target Its Citizens, Report Says” October 3, 2019. The New York Times. https://www.nytimes.com/2019/10/03/world/middleeast/egypt-cyber-attack-phones.html

text: 9. Colin Lencher.“Huawei accuses the US of ‘launching cyber attacks’ against the company“ September 4, 2019.The Verge. https://www.theverge.com/2019/9/4/20849092/huaweicyberattacks-us-government-netowrks-employee-harassment

text: 10. Catalin Cimpanu “A cyber-espionage group has been stealing files from the Venezuelan military” August 5, 2019. ZDNet. https://www.zdnet.com/article/a-cyber-espionage-group-has-been-stealingfiles-from-the-venezuelan-military/

text: 11. Catalin Cimpanu. “Croatian government targeted by mysterious hackers” July 5, 2019. ZDNet. https://www.zdnet.com/article/croatian-government-targeted-by-mysterious-hackers/

text: 12. Michael McGowan. “China behind massive Australian National University hack, intelligence officials say” June 6, 2019. The Guardian. https://www.theguardian.com/australianews/2019/jun/06/china-behind-massive-australian-national-university-hack-intelligence-officialssay

text: 13. “General election 2019: Labour Party hit by second cyber-attack” November 12, 2019. BBC. https://www.bbc.com/news/election-2019-50388879

text: 14. Nicole Perlroth, Matthew Rosenberg. “Russians Hacked Ukrainian Gas Company at Center of Impeachment” January 13, 2020. The New York Times. https://www.nytimes.com/2020/01/13/us/politics/russian-hackers-burisma-ukraine.html

text: 15. Danny Bradbury . “GE Engineer Charged for Novel Data Theft” April 24, 2019. Info Security. https://www.infosecurity-magazine.com/infosec/ge-engineer-charged-data-theft-1/

text: 16. “U.S. announces disruption of ‘Joanap’ botnet linked with North Korea”. January 30, 2019. CyberScoop. https://www.cyberscoop.com/joanap-botnet-north-korea-department-of-justice/

text: 17. “The cyber attack on Parliament was done by a 'state actor' — here's how experts figure that out”. February 20, 2019. ABC News. https://www.abc.net.au/news/2019-02-20/cyber-activists-orstate-actor-attack-how-experts-tell/10825466

text: 18. “While Trump was meeting with Kim Jong Un in Vietnam, North Korean hackers reportedly attacked targets in the US”. March 5, 2019. Business Insider. https://www.businessinsider.com/north-korean-hackers-trump-kim-meeting-mcafee-2019-3

text: 19. “Airbus hit by series of cyber attacks on suppliers”. September 26, 2019. France 24. https://www.france24.com/en/20190926-airbus-hit-by-series-of-cyber-attacks-on-suppliers

text: 20. “Indonesia Says Election Under Attack From Chinese, Russian Hackers”. March 12, 2019. Bloomberg. https://www.bloomberg.com/news/articles/2019-03-12/indonesia-says-poll-underattack-from-chinese-russian-hackers

text: 21. “Cyber-espionage warning: Russian hacking groups step up attacks ahead of European elections”. March 21, 2019. ZDNet. https://www.zdnet.com/article/cyber-espionage-warningrussian-hacking-groups-step-up-attacks-ahead-of-european-elections/

text: 22. “Australian cyber soldiers hacked Islamic State and crippled its propaganda unit – here's what we know”. December 18, 2019. ABC News. https://www.abc.net.au/news/2019-12-18/inside-thesecret-hack-on-islamic-state-propaganda-network/11809426

text: 23. “State-sponsored hackers target Amnesty International Hong Kong with sophisticated cyber- attack”. April 25, 2019. Amnesty International. https://www.amnesty.org/en/latest/news/2019/04/state-sponsored-cyber-attack-hong-kong/

text: 24. “New Report Shows How a Pro-Iran Group Spread Fake News Online”. Mary 14, 2019. The New York Times. https://www.nytimes.com/2019/05/14/world/middleeast/iran-fake-newsreport.html

text: 25. “China behind massive Australian National University hack, intelligence officials say”. June 6,

text: 2019. The Guardian. https://www.theguardian.com/australia-news/2019/jun/06/china-behindmassive-australian-national-university-hack-intelligence-officials-say

text: 26. “Croatian government targeted by mysterious hackers”. July 5, 2019. https://www.zdnet.com/article/croatian-government-targeted-by-mysterious-hackers/

text: 27. “Two Russians accused of election interference arrested in Libya”. July 8, 2019. Cyber Scout. https://cyberscout.com/en/blog/two-russians-accused-of-election-interference-arrested-in-libya

text: 28. “BASF, Siemens, Henkel, Roche target of cyber attacks”. July 24, 2019. Reuters. https://www.reuters.com/article/us-germany-cyber/basf-siemens-henkel-roche-target-of-cyberattacks-idUSKCN1UJ147

text: 29. “New espionage malware found targeting Russian-speaking users in Eastern Europe” October 10, 2019. ZDNet. https://www.zdnet.com/article/new-espionage-malware-found-targetingrussian-speaking-users-in-eastern-europe/

text: 30. “Advanced Israeli spyware is targeting Moroccan human rights activists”. November 2019. TheNextWeb. https://thenextweb.com/security/2019/10/14/advanced-israeli-spyware-istargeting-moroccan-human-rights-activists/

text: 31. “Hacking the hackers: Russian group hijacked Iranian spying operation, officials say”. October 21, 2019. Reuters. https://www.reuters.com/article/us-russia-cyber/hacking-the-hackers-russiangroup-hijacked-iranian-spying-operation-officials-say-idUSKBN1X00AK

text: 32. “Israeli spyware allegedly used to target Pakistani officials' phones”. December 19, 2019. The Guardian. https://www.theguardian.com/world/2019/dec/19/israeli-spyware-allegedly-used-totarget-pakistani-officials-phones

text: 33. “A phishing campaign with nation-state hallmarks is targeting Chinese government agencies”. August 8, 2019.Cyber Scoop. https://www.cyberscoop.com/china-phishing-anomali-nation-stateapt/

text: 34. “Foreign power was behind cyber attack on Czech ministry: Senate”. August 13, 2019. Reuters. https://www.france24.com/en/20190926-airbus-hit-by-series-of-cyber-attacks-onsuppliers

text: 35. “Huawei technicians helped government officials in two African countries track political rivals and access encrypted communications.”. August 15, 2019. The Wall Street Journal. https://www.wsj.com/articles/huawei-technicians-helped-african-governments-spy-on-politicalopponents-11565793017

text: 36. “Labour suffers second cyber-attack in two days” November 12, 2019. The Guardian. https://www.theguardian.com/politics/2019/nov/12/labour-reveals-large-scale-cyber-attack-ondigital-platforms

text: 37. “Extensive hacking operation discovered in Kazakhstan”. November 23, 2019. ZDNet. https://www.zdnet.com/article/extensive-hacking-operation-discovered-in-kazakhstan/

text: References

text: 38. “A Notorious Iranian Hacking Crew Is Targeting Industrial Control Systems”. November 20,

text: 2019. Wired. https://www.wired.com/story/iran-apt33-industrial-control-systems/

text: 39. “Russian 'Gamaredon' Hackers Back at Targeting Ukraine Officials”. December 6, 2019. Security Week. https://www.securityweek.com/russian-gamaredon-hackers-back-targetingukraine-officials

text: 40. “Iran announced it foiled ‘really massive’ foreign cyber attack”. December 11, 2019. Security Affairs. https://securityaffairs.co/wordpress/94981/cyber-warfare-2/iran-foreign-cyberattack.html

text: 41. “Croatian government targeted by mysterious hackers”. July 5, 2019. ZDNet. https://www.zdnet.com/article/croatian-government-targeted-by-mysterious-hackers/

text: 42. “Report on the implementation of the common foreign and security policy – annual report” December 18, 2019. EU Parliament. https://www.europarl.europa.eu/doceo/document/A-9-2019- 0054_EN.html

text: 43. “Chinese Hackers Blamed for Intrusion at Energy Industry Giant Telvent”. September 26,

text: 2012. Krebs on Security. https://www.belfercenter.org/publication/confronting-chinas-effortssteal-defense-information

text: 44. “Energy Manufacturer Also Victimized by IE Zero Day in Watering Hole Attack”. January 2,

text: 2013. The Threat Post. https://threatpost.com/energy-manufacturer-also-victimized-ie-zero-daywatering-hole-attack-010213/77359/

text: 45. “The French Connection: French Aerospace-Focused CVE-2014-0322 Attack Shares Similarities with 2012 Capstone Turbine Activity”. February 25, 2014. CrowdStrike Blog. https://www.crowdstrike.com/blog/french-connection-french-aerospace-focused-cve-2014-0322attack-shares-similarities-2012/ 46. “Advanced Persistent Threat Groups”. Fireeye. https://www.fireeye.com/current-threats/aptgroups.html

text: 47. “U.S. accuses pair of stealing secrets, spying on GE to aid China”. April 23, 2019. Reuters. https://www.reuters.com/article/us-usa-justice-ge/us-accuses-pair-of-stealing-secrets-spying-onge-to-aid-china-idUSKCN1RZ24O

text: “The number of nationstate sponsored cyberattacks targeting the economy increased during 2019.” in ETL 2020

text: Related

text: ENISA Threat Landscape Report The year in review A summary on the cybersecurity trends for the period between January 2019 and April 2020. READ THE REPORT ENISA Threat Landscape Report List of Top 15 Threats ENISAs’ list of the top 15 threats of the period between January 2019 and April READ THE REPORT 2020. ENISA Threat Landscape Report Research topics Recommendations on research topics from various quadrants in cybersecurity READ THE REPORT and cyber threat intelligence. ENISA Threat Landscape Report Sectoral and thematic threat analysis Contextualised threat analysis between January 2019 and April 2020. READ THE REPORT ENISA Threat Landscape Report Emerging trends Main trends in Cybersecurity observed READ THE REPORT between January 2019 and April 2020. ENISA Threat Landscape Report Cyber Threat Intelligence overview The current state of play of cyber threat intelligence in the EU. READ THE REPORT

text: About

text: _ The agency The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found at www.enisa.europa.eu. Contributors Christos Douligeris, Omid Raghimi, Marco Barros Lourenço (ENISA), Louis Marinos (ENISA) and all members of the ENISA CTI Stakeholders Group: Andreas Sfakianakis, Christian Doerr, Jart Armin, Marco Riccardi, Mees Wim, Neil Thaker, Pasquale Stirparo, Paul Samwel, Pierluigi Paganini, Shin Adachi, Stavros Lingris (CERT EU) and Thomas Hemker. Editors Marco Barros Lourenço (ENISA) and Louis Marinos (ENISA). Contact For queries on this paper, please use enisa.threat.information@enisa.europa.eu. For media enquiries about this paper, please use press@enisa.europa.eu. Legal notice Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. Copyright Notice © European Union Agency for Cybersecurity (ENISA), 2020 Reproduction is authorised provided the source is acknowledged. Copyright for the image on the cover: © Wedia. For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders. ISBN: 978-92-9204-354-4 DOI: 10.2824/552242 Vasilissis Sofias Str 1, Maroussi 151 24, Attiki, Greece Tel: +30 28 14 40 9711 info@enisa.europa.eu www.enisa.europa.eu All rights reserved. Copyright ENISA 2020. https://www.enisa.europa.eu


text: Entities involved in a breach. Source: Horizon

identifier: ENISA Threat Landscape 2020 - Data Breach

text: From January 2019 to April 2020

text: Data breach

text: ENISA Threat Landscape

text: Overview

text: A data breach is a type of cybersecurity incident in which information (or part of an information system) is accessed without the right authorisation, typically with malicious intent, leading to the potential loss or misuse of that information. It also includes ‘human error’ that often happens during the configuration and deployment of certain services and systems, and may result in unintentional exposure of data. In many cases, companies or organisations are not aware of a data breach happening in their environment because of the sophistication of the attack and sometimes the lack of visibility and classification in their information system. Based on research, it takes approximately 206 days to identify a data breach in an organisation. Thus, the time to contain, remediate and recover the data means that it takes longer to return to normal. Despite all the risks involved, organisations keep even more data using cloud storage infrastructures and complex on-premises environments. These environments are gradually more exposed to new and different risks, proportional to the sensitiveness of the information stored. It comes as no surprise that, the number of data breaches increased in 2019 and 2020. New findings also suggest that the impact is not felt exclusively when a data breach is discovered - the financial impact can remain for more than 2 years after the initial incident. __Findings increase in the total number of breaches

text: by midyear 2019 compared with 2018. of the data breaches were financially

text: motivated. Nearly 25% had long term strategic goals (nation state/ espionage). of the data breaches involve phishing

text: activity according to IOCTA 2019. A report suggests that phishing is at the top of the list of major contributors to data breaches. The report also mentions that e-mail is the prime delivery method of malware (94%) in a chain of events leading to a data breach. 5 of data breaches involved hacking. Other

text: tactics utilised are social attacks (33%), malware (28%) and mistakes or errors (21%). Since 2016 hacking has been the main cause of data breaches in healthcare. During 2019 nearly 59% of the reported breaches were caused by hacking. of the data breaches expose e-mails.

text: Although username/e-mail and passwords (i.e credentials) are easily changed in contrast with personal details (i.e. date of birth), the focus is mostly on these in data breaches. of the responders to a Eurobarometer

text: survey responded that they are concern about their data being accessed by criminals and fraudsters.

text: Timeline

text: 2019 _ January _ February _ March MEGA cloud (NZ) suffered 620 million accounts stolen 12,5M medical records of a data breach exposing from 16 hacked websites pregnant woman of Indian 770 million emails and 21 now for sale on dark web, government (IN) healthcare 9 10 seller boasts. center, going back to 2014 million passwords. were exposed to public. _ October _ September _ August The account information of Mastercard (BE) suffered a Major breach found in over 7.5 million users from data breach affecting ca. biometrics system Adobe (US) was exposed 90K customers in Europe. used by banks, (UK) due to an unprotected police and defence 18 16 online database. firms. 2020 _ November _ December _ January UniCredit (IT) victim of a The smart camera provider 250 million customer data breach leaking 3 Wyze (US) suffered two service and support million records. breaches at the end of records from December when databases Microsoft (US), going were left exposed for over all the way back to two weeks. 2005, were breached. _ April _ May Facebook (US) reported a First American Financial data breach exposing 540 Corp. (US) leaked hundreds million user records on of millions of title 12 13 exposed servers. insurance records. _ July _ June Personal information from 100 million records Capital One (US) credit card exposed by unauthorised customers breached. access to a data storage from Evite customers. _ February _ March _ April An unprotected Google (US) Biometric solutions Hackers obtained the cloud server containing the company Antheus login details from two personal data of 200 million Tecnologia (BR) Marriott (US) employees US residents. suffered from a data and broke into the 23 24 leak. system in January 2020.

text: Trends

text: _The cost of a data breach for organisations spreads over many years Security researchers found that one third of the costs related to a data breach are incurred more than 1 year after the incident. In more detail, around 22% of these costs are incurred in the second year, while 11% of the costs are accounted for more than 2 years after the initial incident. These rates were higher for highly regulated organisations, such as those in financial services and healthcare, in comparison with other sectors. The adoption of cloud or multi-cloud environments is increasing rapidly similar to the amount of data stored and processed in these environments. _Small mistakes could lead to big breaches Securing the cloud environment without losing all the flexibility it brings to the infrastructure and resources can be problematic. A single misconfiguration can result in exposing the entire sensitive database. A security researcher believes that majority of data breaches in the cloud are a result of misconfiguration and they are mostly unintentional. Netflix, Ford and TD Bank are only few examples among many others. From a different perspective, although data breaches resulting from malicious attempts still cost more, breaches caused by system glitches or human errors still represent a considerable cost on average US $3,24 million (ca. €2,74 million). _Data breaches cost more to small business The cost of data breaches to enterprises or large organisation with more than 25.000 employees is US $204 (ca. €173) per employee. The total amount estimation at around US $5,11 million (ca. €4,33 million). In contrast, for small companies (500-1.000 employees) the average cost is around US $3.533 (ca. €3.000) per employee. This represents a total cost of US $2,65 million (ca. €2,24 million) for small businesses. _ Financial gain is the prime motivation Malicious/threat actors are known to be the ones pulling the string in data breaches (bearing in mind that sometimes they may be the result of a mistake). In that sense, external threat actors are the main cause of  data breaches, and this could include activities such as botnets . In this regard, financial gain has been repeatedly identified as the main motivation behind data breaches facilitated by these groups of actors.  Espionage also was one of the key motives behind data breaches but not as high up the list as personal or financial gain. This trend was almost consistent with the results observed in 2010-2011.

text: Trends

text: _ Quantum-computing and data security concerns Cryptography requirements play a vital role in the quantum-computing era and highlight critical security issues. 72% of organisations believe that quantum computing will affect their crypto related operations strategically (in the next 5 years). According to the results of the survey, 92% of respondents are concerned about the exposure of sensitive data by using this technology in the computing industry. The main strategies respondents suggested for tackling such concerns were changing the security architecture and deploying key managements infrastructures. _Healthcare - a consistent focus for malicious actors Healthcare continued to be one of the most attractive targets for   cybercriminals using ransomware and phishing techniques costing such organisations millions of euros to contain and recover from the impact. In 2019, 400 healthcare companies reported a data breach in patient records. This was a record for healthcare organisations. _Multi-cloud - the new challenge for data security A survey conducted by a security researcher reported that 9 out of 10 companies are thinking of using or already using cloud environments. Approximately 44% of their responders also believe that these environments are challenging for implementing proper data security measures. __Types of data exposed (%) Type of data 2019 2018 2017 E-mail 70 44 32 Password 64 39 27 Name 23 37 41 Miscellaneous 18 19 15 Social security number 11 22 27 Credit card 11 16 19 Address 11 22 30 Account 10 7 4 Unknown 8 13 18 Date of birth 8 13 12 Medical 5 9 7 Financial 5 13 19 8 Source: Cyber Risk Analytics

text: Trends

text: _Continuous decrease in ‘card-present’ breaches According to a security report, a decrease in point of sale and cardskimming breaches (where card is presented) was identified during 2019.  This represents a shift from traditional ATM skimming and card payments to web application in retail industry. Although the number of incidents decreased in this area, is not an accurate to conclude that the number of data breaches decrease rather but a shift in the vector. The decrease though might be related to a wider implementation of chip and pin enabled cards/terminals (also known as EMV). _What to expect in the near future? According to a security researcher, healthcare organisations should be prepared for a 10%-15% increase in the number of data breaches, in which their service providers will be the main target . More generally, based on the results from the first 6 months of 2019, it is expected that the number of data breaches will increase at an alarming rate, despite the awareness of senior leaders and the effort that many organisations are putting into to secure their data. _Data breaches by sector and organization size Incidents Breaches Small Large Unknown Accommodation 61 34 7 20 Administrative 17 6 6 5 Agriculture 2 2 0 0 Construction 11 7 3 1 Education 99 14 8 77 Entertainment 10 2 3 5 Finance 207 26 19 162 Healthcare 304 29 25 250 Information 155 20 18 117 Management 2 1 1 0 Manufacturing 87 10 22 55 Mining 15 2 5 8 Other services 54 6 5 43 Professional 157 34 10 113 Public 330 17 83 230 Real Estate 14 6 3 5 Retail 139 46 19 74 Trade 16 4 8 4 Transportation 36 3 9 24 Utilities 8 2 0 6 Unknown 289 0 109 180 Total 2.013 271 363 1,379 Source: Verizon DBIR, 2019

text: Attack vectors

text:  E-MAIL/PHISHING. Impersonating a third-party supplier or a partner using e-mail is an easy win for the malicious actors. This is known to be the vector most often used by cybercriminals to target their victims and the cause of most of data breaches (almost 40% of breaches in 7, healthcare ).  CLOUD/WEB APPLICATIONS. This reflects web applications being used as a vector for attempts by malicious actors to breach data or critical operations. Stealing credentials to access web-based e-mail portals is a prime example. Exploiting weaknesses in application servers to inject/deliver information-stealing malware or formjacking attacks are  other examples in this vector.  INSIDER THREAT. This mainly refers to unauthorised or malicious attempts to use resources. It should be noted that generally in analysis and reporting misconfiguration or mistakes (human error) by internal teams may also be referred to as ‘insiders’. Although most data breaches are facilitated by external malicious actors, it is still the case that insiders with or without privileged access are playing a key role in data breaches. “In many cases, companies or organisations are not aware of a data breach happening in their environment because of the sophistication of the attack and sometimes the lack of visibility and classification in their information system.” in ETL 2020

text: Mitigation

text: _Proposed actions  Data breach is generally the outcome of other threats and the mitigation overlaps with others discussed in this report.  Consider investing in hybrid data security tools that focus on operating in a shared responsibility model for cloud-based environments.  Develop and maintain a cybersecurity awareness plan. Provide training and simulation scenarios for identifying social engineering and phishing campaigns for staff.  Establish and maintain an incident response team and evaluate incident response plans frequently.  Identify and classify sensitive/personal data and apply measures for encrypting such data in transit and at rest. In other words deploy data loss prevention capabilities.  Increase investment in detection and alerting tools and in the ability to contain and respond to a data breach.  Develop and maintain strong policies enforcing strong passwords (password management) and the use of multi-factor authentication.  Consider using models that take the ‘least privilege’ approach to provide security for both on- and off-premises resources (i.e. zerotrust models).  Invest and create policies and plans for engaging with governance, risk management and compliance teams. “During the next decade, cybersecurity risks will become harder to assess and interpret due to the growing complexity of the threat landscape, adversarial ecosystem and expansion of the attack surface.” in ETL 2020

text: References

text: 1. “What is data breach?” Norton. https://us.norton.com/internetsecurity-privacy-data-breacheswhat-you-need-to-know.html

text: 2. “What is data breach?” Malwarebytes. https://www.malwarebytes.com/data-breach/

text: 3. “Cost of Data Breach Report.” 2019. IBM Security, Ponemon Institute. https://www.ibm.com/security/data-breach

text: 4. Dhritimaan Shukla, Kush Wadhwa. “Data breach – threat landscape. Unauthorised exposure of an organisation’s critical data.” PWC India. https://www.pwc.in/consulting/forensic-services/databreach-threat-landscape.html

text: 5. “Verizon Data Breach Investigations Report.” 2020. Verizon. https://enterprise.verizon.com/resources/reports/dbir/

text: 6. Catherine De Bolle. “Internet Organised Crime Threat Assessment (IOCTA).” 2019. European Cyber Crime Centre (EC3), Europol. https://www.europol.europa.eu/iocta-report

text: 7. “2020 Healthcare Cybersecurity Horizon Report.” 2020. Fortified Health Security. https://www.fortifiedhealthsecurity.com/resources/2020-healthcare-cybersecurity-horizonreport/

text: 8. Inga Goddijn. “2019 Midyear QuickView Data Breach Report – Cyber Risk Analytics.” August

text: 2019. https://pages.riskbasedsecurity.com/hubfs/Reports/2019/2019%20MidYear%20Data%20Breach %20QuickView%20Report.pdf

text: 9. Troy Hunt. “The 773 Million Record "Collection #1" Data Breach.” January 17, 2019. TroyHunt. https://www.troyhunt.com/the-773-million-record-collection-1-data-reach/

text: 10. Chris Williams. “620 million accounts stolen from 16 hacked websites now for sale on dark web, seller boasts.” February 11, 2019. The Register. https://www.theregister.com/2019/02/11/620_million_hacked_accounts_dark_web/

text: 11. Catalin Cimpanu. “Indian govt agency left details of millions of pregnant women exposed online.” April 1, 2019. ZDNet. https://www.zdnet.com/article/indian-govt-agency-left-details-ofmillions-of-pregnant-women-exposed-online/

text: 12. “Losing Face: Two More Cases of Third-Party Facebook App Data Exposure.” April 3, 2019. UpGuard. https://www.upguard.com/breaches/facebook-user-data-leak

text: 13. “First American Financial Corp. Leaked Hundreds of Millions of Title Insurance Records.” 24 May, 2019. KrebsonSecurity. https://krebsonsecurity.com/2019/05/first-american-financial-corpleaked-hundreds-of-millions-of-title-insurance-records/

text: 14. “Data Incident, Evite.” May 14, 2019. Evite. https://www.evite.com/security/update

text: 15. “Information on the Capital One Cyber Incident.” September 23, 2019. CapitalOne. https://www.capitalone.com/facts2019/

text: 16. Josh Taylor. “Major breach found in biometrics system used by banks, UK police and defence firms.” 14 August, 2019. The Guardian. https://www.theguardian.com/technology/2019/aug/14/major-breach-found-in-biometricssystem-used-by-banks-uk-police-and-defence-firms

text: 17. Neil Hodge. “Mastercard reveals data breaches in third-party loyalty program.” August 27,

text: 2019. Compliance Week. https://www.complianceweek.com/data-privacy/mastercard-reveals-data-breaches-in-thirdparty-loyalty-program/27614.article

text: 18. Catalin Cimpanu. “Adobe left 7.5 million Creative Cloud user records exposed online.” October, 26.2019. ZDNet. https://www.zdnet.com/article/adobe-left-7-5-million-creative-clouduser-records-exposed-online/

text: 19. Charlie Osborne. “UniCredit reveals data breach exposing 3 million customer records.” October 28, 2019. ZDNet. https://www.zdnet.com/article/unicredit-reveals-data-breach-exposing- 3-million-customer-records/

text: 20. Chris Isidore. “Smart camera maker Wyze hit with customer data breach.” December 30.2019. CNN. https://edition.cnn.com/2019/12/30/tech/wyze-data-breach/index.html

text: 21. Davey Winder. “Microsoft Security Shocker As 250 Million Customer Records Exposed Online.” January 22, 2020. Forbes. https://www.forbes.com/sites/daveywinder/2020/01/22/microsoftsecurity-shocker-as-250-million-customer-records-exposed-online/#2d3f9dca4d1b

text: 22. Paul Bischoff. “US property and demographic database of 200 million records leaked on the web.” March 5, 2020. comparitech. https://www.comparitech.com/blog/vpn-privacy/200-millionus-database-leaked/

text: 23. Jim Wilson.“Brazil: Millions of Records Leaked, Including Biometric Data.” March 11, 2020. Safety Detectives. https://www.safetydetectives.com/blog/antheus-leak-report/

text: 24. Zack Whittaker.“Marriot says 5.2 million guest records were stolen in another data breach.” April 1, 2020. Techrunch. https://techcrunch.com/2020/03/31/marriott-hotels-breachedagain/?renderMode=ie11

text: 25. “2019 Thales Data Threat Report – Global Edition” Thales Security, 2019. https://cpl.thalesgroup.com/data-threat-report

text: 26. “2020 Thales Data Threat Report – Global Edition” Thales Security, 2020. https://cpl.thalesgroup.com/data-threat-report

text: 27. Laura Paine. “2019 Verizon DBIR Shows Web Applications and Human Error as Top Sources of Breach.” May 8, 2019. Veracode. https://www.veracode.com/blog/security-news/2019-verizondbir-shows-web-applications-and-human-error-top-sources-breach

text: Related

text: About

text: Regulation (EU) No 526/2013


text: Distribution of DDoS attacks by type. Source: Kapersky

text: Distribution of DDoS attack vectors. Source: NexusGuard

text: Source: Imperva

identifier: ENISA Threat Landscape 2020 - Distributed denial of service

text: From January 2019 to April 2020

text: Distributed denial of service

text: ENISA Threat Landscape

text: Overview

text: Distributed Denial of Service (DDoS) attacks are known to occur when users of a system or service are not able to access the relevant information, services or other resources. This stage can be accomplished by exhausting the service or overloading the component of the network infrastructure. Malicious actors increased the number of attacks by targeting more sectors with different motives. While defence mechanisms and strategies are becoming more robust, malicious actors are also 3,4,5 advancing their technical skills. Reports suggest that the usage of reflected and amplified attack techniques facilitating new vectors other than the commonly known ones (UDP amplification etc.) has increased. Malicious actors are also improving their commercial tactics by starting to advertise their services on the web. Historically, DDoS services were advertised in the dark web forums, but now they use common social media channels such as YouTube and Redit to promote their services. In 2019, we saw new entries in the top 10 list of source countries generating DDoS traffic (Hong Kong, South Africa, etc.). It was also the year that saw an increase in DDoS activity by botnets. IoT devices are a ‘hotbed’ for DDoS botnets, and China (24%), Brazil (9%) and Iran (6%) were considered as the countries most infected with botnet agents. A security researcher predicted that, the implementation and distribution of 5G networks will exponentially increase the number of connected devices, hence the expansion of botnet networks. Although DoS attacks are not new to cybersecurity and network defenders, their level of sophistication is increasing, and malicious actors are observed to be actively running more reconnaissance activities than 3,8 before. __Findings increase in total number of attacks during

text: Q3 2019 compared with the same period of 2018 of all DDoS attacks were SYN-Floods

text: of the mitigated attacks during Q3 2019

text: were using more than two vectors of the DDoS attacks lasted less than 10

text: minutes hours was the duration of the longest DDoS

text: attack in Q2 2019

text: Kill chain

text: Denial of service Reconnaissance Weaponisation Delivery Exploitation Step of Attack Workflow Width of Purpose Command & Actions on Installation Control Objectives The Cyber Kill Chain framework was developed by Lockheed Martin, adapted from a military concept related with the structure of an attack. To study a particular attack vector, use this kill-chain diagram to map each step of the process and reference the tools, techniques and procedures used by the attacker. MORE INFORMATION

text: Incidents

text: _The top five DDoS attacks 500-580 MILLION PACKETS PER SECOND SYN FLOODS. Among all the techniques used by malicious actors, SYN Flood is still considered to be challenging to mitigate based on its characteristics, the infrastructure targeted and the fact that they require more hardware to handle a high volume of packets. In January 2019, a security researcher observed a record of SYN flood activity distributing 500 million packets per second (mpps) targeting one of its clients and, subsequently, in April 2019, the volume increased to 580 mpps. WS-DISCOVERY. Web services dynamic discovery (WS-Discovery) is a multicast discovery protocol. It has been observed being used mostly by IoT devices to automatically discover each node on local area networks (LANs) but, like other protocols, it may not be used only for its intended 5. purpose, especially in the IoT realm Malicious actors have found it to be a good hotbed for amplifying attacks. A security researcher reported an amplification factor of 95x while another researcher reported an increase of 15.000% compared with the original byte size. REFLECTED AND AMPLIFIED ATTACKS. These types of attacks are widely and historically known to feature a small request to deliver a larger payload. In summary, the malicious actor will spoof the sender’s (victim) IP address and subsequently, the recipient host will send all the related responses to the victim. This methodology is mainly effective on UDP based protocol because of their connectionless nature and amplification factor (i.e. CLDAP has an amplification factor of x50-x70). However, TCP protocol is not prone to this type of attack. A good example of such attempts are SYN-ACK reflected and amplified flooding attacks – this type of flood does not necessarily need to be high bandwidth to have an impact. In contrast, having a high packet per second ration can keep the attack below the radar and increase its effectiveness. BIT-AND-PIECE/CARPET BOMBING DDoS. This type of distributed and reflective denial of service (DRDoS) attack is known to target mostly 17 18 telecommunication and service provider industries. In one instance of this attack, a random selection of IP addresses of an Internet Service Provider was targeted to reflect the traffic to the edge routers of the provider. Thus, the victim was not able to identify the DDoS until their service was overwhelmed by their own selected IP range. MULTI-VECTOR DDOS ATTACKS. Malicious actors often carry out multiple vectors of DoS attacks to add complexity and variety to their attempt. This means that by merely automating different application layer (HTTP Flood, DNS Flood etc.) and network layer (UDP/TCP reflection/amplification etc.) types of attack, they will try to maximise its impact by saturating the bandwidth as well as resources or services in the targeted environment. SYN 79.70% UDP 9.40% HTTP 1.70% ICMP 0.50% 0% 20% 40% 60% 80% 100%

text: Attack vectors

text: _ How Similar to previous years, 2019 was no exception in terms of UDP floods. According to a security researcher, UDP flood was the most popular attack vector and the team believes that might be related to the dominate adoption of this protocol in high-risk industries such as gaming. SYN flood, DNS response and TCP based attacks followed UDP floods in the list of top attack vectors. Multi-vector attacks were also observed during this period. However, a security researcher believes that some of the multi-vector attacks are an unintended by-product of a DoS attempt. A cybersecurity report suggested that DNS Amplification attacks were observed by its team as the top DDoS attack vector followed by HTTP flood and TCP SYN attacks. The observations of attack vectors in Q3 2019 were similar with SYN floods, the top vector followed by UDP, TCP and HTTP attacks. DNS Amplification Attack 43.00% HTTP Flood 14.00% TCP SYN Attack 7.50% TCP ACK Attack 7.00% HTTPS Flood 7.00% UDP Attack 6.50% TCP RST Attack 3.50% IP fragmentation attack 3% CLDAP Reflection Attack 2% SSDP Amplification Attack 2% NTP Amplification attack 1.50% UDP Fragmentation attack 1.50% 0% 5% 10% 15% 20% 25% 30% 35% 40% 45% 50% __Attack Duration 21% 1 hr 12+ hrs 15 min - 30 min 8% 30 min - 1 hr 52% 6 hrs - 12 hrs under 15 min 10% 5% 4%

text: Mitigation

text: _Proposed actions  Understanding services and critical resources and prioritising defence where these can be overloaded. Ensuring a response plan is in place for such scenarios.  Depending on the requirements, considering DDoS protection service or a DDoS managed service provider . Use of methods such as monitoring for fast identification of infections.  Similar to the above point, publishing services through content delivery networks can be an effective way of absorbing volumetric attempts (requires other techniques in place for more sophisticated attacks).  Internet Service and Cloud Providers play a critical role in defending against DDoS attacks. Having a clear communication plan and channel with them is key to a successful response to a denial of service attack.  Developing a proactive and strong defensive posture before a critical failure occurs involving the related team and vendors to configure and tune controls based on specific business requirements. Facilitating cache servers or dropping inappropriate queries/request in the application layer at source and implementing BCP for service providers are good instances of proactive measures.  Ensure you test and re-evaluate your defence techniques, technologies and providers.  Produce a risk register by analysing your environment inside-out. Starting from your critical assets inside and working your way to your Internet footprint and presence. “Although DDoS attacks are not new to cybersecurity and network defenders, their level of sophistication is increasing, and malicious actors are observed to be actively running more reconnaissance activities than before” in ETL 2020

text: References

text: 1. “Understanding Denial-of-Service Attacks” November 20, 2019. CISA. https://www.uscert.gov/ncas/tips/ST04-015

text: 2. Oleg Kupreev, Ekaterina Badovskaya, Alexander Gutnikov. “DDoS attacks in Q1 2019” May 21,

text: 2019. Kaspersky. https://securelist.com/ddos-report-q1-2019/90792/

text: 3. “Q4 2019 - The State of DDoS Weapons Report.” 2019. A10 Networks. https://www.a10networks.com/marketing-comms/reports/state-ddos-weapons/

text: 4. Chad Seaman. “Anatomy of a SYN-ACK Attack.” July 2, 2019. Akamai. https://blogs.akamai.com/sitr/2019/07/anatomy-of-a-syn-ack-attack.html

text: 5. Brandon Vigliarolo. “A new type of DDoS attack can amplify attack strength by more than 15,300%.” September 18, 2019. TechRepublic. https://www.techrepublic.com/article/a-new-type-ofddos-attack-can-amplify-attack-strength-by-more-than-15300/

text: 6. Oleg Kupreev, Ekaterina Badovskaya, Alexander Gutnikov. “DDoS attacks in Q4 2018” February 7,

text: 2019. Kaspersky. https://securelist.com/ddos-attacks-in-q4-2018/89565/

text: 7. Oleg Kupreev, Ekaterina Badovskaya, Alexander Gutnikov. “DDoS attacks in Q3 2019” November 11, 2019. Kaspersky. https://securelist.com/ddos-report-q3-2019/94958/

text: 8. “2019 Website Threat Research Report.” 2019. sucuri

text: 9. “DDoS attacks up 241% in Q3 2019 compared to same period last year.” November 19, 2019. Neustar. https://www.home.neustar/about-us/news-room/press-releases/2019/ddos-attacks-up- 241--in-q3-2019-compared-to-same-period-last-year#

text: 10. “2019 Half-Year DDoS Trends Report.” 2019. Corero Security. https://www.corero.com/blog/infographic-2019-mid-year-ddos-trends-report/

text: 11. Nadav Avital, Avishay Zawoznik, Johnathan Azaria, Kim Lambert. “2019 Global DDoS Threat Landscape Report.” 2019. Imperva. https://www.imperva.com/blog/2019-global-ddos-threatlandscape-report/

text: 12. Tomer Shani. “Updated: This DDoS Attack Unleashed the Most Packets Per Second Ever. Here’s Why That’s Important.” April 30, 2019. Imperva. https://www.imperva.com/blog/this-ddos-attackunleashed-the-most-packets-per-second-ever-heres-why-thats-important/

text: 13. “Web Services Dynamic Discovery (WS-Discovery) Version 1.1” July 1, 2009. OASIS.http://docs.oasis-open.org/ws-dd/discovery/1.1/wsdd-discovery-1.1-spec.html

text: 14. Jonathan Respeto. “New DDoS Vector Observed in the Wild: WSD attacks hitting 35/Gbps.” September 18, 2019. Akamai. https://blogs.akamai.com/sitr/2019/09/new-ddos-vector-observed-inthe-wild-wsd-attacks-hitting-35gbps.html

text: 15. “Threat Alert: TCP Amplification Attacks.” November 9, 2019. Radware. https://blog.radware.com/security/2019/11/threat-alert-tcp-reflection-attacks/

text: 16. “Kaspersky report finds over half of Q3 DDoS attacks occurred in September.” November 11,

text: 2019. Kaspersky. https://usa.kaspersky.com/about/press-releases/2019_kaspersky-report-findsover-half-of-q3-ddos-attacks-occurred-in-september

text: 17. “DDoS Threat Report 2019 Q1.” 2019. NexusGuard. https://blog.nexusguard.com/threatreport/ddos-threat-report-2019-q1

text: 18. “International traffic – DDoS.” September 22, 2019. Cool Ideas. https://coolzone.cisp.co.za/announcements.php?announcement=2038-international-traffic-ddoscool-ideas

text: 19. Catalin Cimpanu. “Carpet-bombing' DDoS attack takes down South African ISP for an entire day.” September 24, 2019. ZDNet. https://www.zdnet.com/article/carpet-bombing-ddos-attacktakes-down-south-african-isp-for-an-entire-day/

text: 20. “Guidance following recent DoS attacks in the run up to the 2019 General Election.” November 13, 2019. NCSC. https://www.ncsc.gov.uk/guidance/guidance-following-recent-dosattacks-2019-general-election

text: 21. V. Revuelto, S. Meintanis, K. Socha. “DDoS Overview and Response Guide.” March 10, 2017. CERT-EU. https://cert.europa.eu/static/WhitePapers/CERT-EU_Security_Whitepaper_DDoS_17- 003.pdf

text: 22. “State of the Internet/Security DDoS and Application Attacks, Volume 5, Issue 1.” 2019. Akamai. https://www.akamai.com/us/en/multimedia/documents/state-of-the-internet/state-ofthe-internet-security-ddos-and-application-attacks-2019.pdf

text: 23. P. Fergusson, D. Senie. “Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing.” May 2000. IETF Tools. https://tools.ietf.org/html/bcp38

text: 24. Pierluigi Paganini. “Cyber Defense Magazine Sept Edition 2019.” September 4, 2019. SecurityAffairs. https://securityaffairs.co/wordpress/90795/breaking-news/cyber-defensemagazine-september-2019.html

text: Related

text: ENISA Threat Landscape Report The year in review A summary on the cybersecurity trends for the period between January 2019 and April 2020. READ THE REPORT ENISA Threat Landscape Report List of Top 15 Threats ENISAs’ list of the top 15 threats of the period between January 2019 and April READ THE REPORT 2020. ENISA Threat Landscape Report Research topics Recommendations on research topics from various quadrants in cybersecurity READ THE REPORT and cyber threat intelligence. ENISA Threat Landscape Report Sectoral and thematic threat analysis Contextualised threat analysis between January 2019 and April 2020. READ THE REPORT ENISA Threat Landscape Report Emerging trends Main trends in Cybersecurity observed READ THE REPORT between January 2019 and April 2020. ENISA Threat Landscape Report Cyber Threat Intelligence overview The current state of play of cyber threat intelligence in the EU. READ THE REPORT

text: About

text: _ The agency The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found at www.enisa.europa.eu. Contributors Christos Douligeris, Omid Raghimi, Marco Barros Lourenço (ENISA), Louis Marinos (ENISA) and all members of the ENISA CTI Stakeholders Group: Andreas Sfakianakis, Christian Doerr, Jart Armin, Marco Riccardi, Mees Wim, Neil Thaker, Pasquale Stirparo, Paul Samwel, Pierluigi Paganini, Shin Adachi, Stavros Lingris (CERT EU) and Thomas Hemker. Editors Marco Barros Lourenço (ENISA) and Louis Marinos (ENISA). Contact For queries on this paper, please use enisa.threat.information@enisa.europa.eu. For media enquiries about this paper, please use press@enisa.europa.eu. Legal notice Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. Copyright Notice © European Union Agency for Cybersecurity (ENISA), 2020 Reproduction is authorised provided the source is acknowledged. Copyright for the image on the cover: © Wedia. For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders. ISBN: 978-92-9204-354-4 DOI: 10.2824/552242 Vasilissis Sofias Str 1, Maroussi 151 24, Attiki, Greece Tel: +30 28 14 40 9711 info@enisa.europa.eu www.enisa.europa.eu All rights reserved. Copyright ENISA 2020. https://www.enisa.europa.eu