Story image

By 'taking the perspective of the attacker' organisations may fare better

03 Oct 2016

Digital Shadows has recently looked into the many ways that threat actors are using the growing sophistication of criminal business models, characterised by the automation and replication of previously manual processes (industrialisation).

Michael Marriott, security research at Digital Shadows, has identified a number of examples of how breached data can currently be industrialised, based on incidents the company has detected in the past 24 months.

Botnets

Marriot explains that these particular datasets contain email addresses that can be used in the operation of botnets, which can subsequently be used to deliver spam or more malicious pieces of malware.

Credential harvesting is another example that the cyber exec highlights. He explains that malware such as Pony Loader can be used to steal credentials and/or online currency.

“The malware is available with a control panel, user management, logging features, a database to manage all the data, and password list to conduct brute force style attacks against less-secure cyber assets,” says Marriott.

Spear-phishing

“Like botnets, threat actors can use breached data in targeted spear-phishing campaigns in order to distribute malware such as banking trojans and ransomware,” he explains.

According to Digital Shadows, the below diagram shows the flow of stolen data through the many industrialised ‘services’ listed above and then onwards to other malicious activities.

“Notably, the graphic above highlights how stolen data that has been used for spear-phishing or in the creation of a botnet can be used to accrue even more data through data-stealing ransomware and banking Trojans,” says Marriott.

“This reuse of data creates a “virtuous circle” for the malicious actor where an initial investment in breached data in turn creates a growing pool of stolen information that can be put to a variety of uses," he adds. 

Marriott explains that by taking the perspective of an attacker, organisations can better understand the risks and threats faced by clients.

“This guides our approach towards public data breach incidents, where our analysts consider how attractive and useful a given dataset could be for a malicious actor in order to produce more structured and considered assessments of their severity.”  

Interview: What you can expect from LogicMonitor's APAC expansion
LogicMonitor is a provider of SaaS-based infrastructure monitoring software for hybrid IT environments – and it has big plans to shake up Asia Pacific this year.
Cryptomining apps discovered on Microsoft’s app store
It is believed that the eight apps were likely developed by the same person or group.
A multi-cloud approach - what is in it for me?
OVH CEO Michel Paulin explains the benefits of a multi-cloud approach to an organisations digitalisation and what to consider before implementation.
Why the IT service integration market is becoming highly automated
"The SIAM market is not large, but it is one of the fundamental pillars of every digital transformation strategy."
Intel and Rakuten partner to address 5G network gap
“We believe this full end-to-end virtualised network will help us to shift away from reliance on dedicated hardware and legacy infrastructure.”
Spoofs, forgeries, and impersonations plague inboxes
It pays to double check any email that lands in your inbox, because phishing attacks are so advanced that they can now literally originate from a genuine sender’s account – but those emails are far from genuine.
HCL and IBM collaborate to encourage global hybrid cloud uptake
HCL announced a collaboration with IBM designed to help advance the hybrid cloud journeys of organisations worldwide. 
Robots to the fore – Key insights for New Zealand Business into RPA in 2019
From making artificial intelligence a business reality to closer ties to human colleagues, robotic process automation is gearing up for a strong 2019.