Kaspersky Lab today published “APT Threat Evolution,” the first quarterly summary of its subscriber-only threat intelligence reports.
Kaspersky Lab publishes first quarterly summary of the APT landscape
Woburn, MA – April 27, 2017 – Kaspersky Lab today published “APT Threat Evolution,” the first quarterly summary of its subscriber-only threat intelligence reports. The report for the first three months of 2017 shows a sharp rise in the sophistication of nation-state backed cyber attacks as threat actors increasingly use wipers and fileless malware.
The new quarterly APT trends reports will be freely available and will highlight significant developments in targeted attacks as well as emerging trends that demand immediate attention from business and other organizations. The content of the Q1 report is drawn from Kaspersky Lab experts’ observations of APT actors’ activity during the quarter.
Highlights in Q1, 2017 include:
- Wipers are being harnessed by targeted threat actors, both for cybersabotage and for deleting tracks after cyberespionage operations. An evolved generation of Wipers was used in the new wave of Shamoon attacks. The subsequent investigation led to the discovery of StoneDrill and its code similarities to the NewsBeef (Charming Kitten) group. A StoneDrill victim was found in Europe.
- Targeted attackers diversify into money theft. The long term tracking of the Lazarus group has identified a sub-group that Kaspersky Lab has called BlueNoroff, actively attacking financial institutions in different regions, including a high profile attack in Poland. BlueNoroff is believed to be behind the infamous Bangladesh Bank heists.
- Fileless malware is being used in attacks by both targeted threat actors and cybercriminals in general – helping to avoid detection and make forensic investigations harder. Kaspersky Lab’s experts have found examples in the lateral movement tools used in the Shamoon attacks, in attacks against Eastern European banks, and in the hands of a number of other APT actors.
“The targeted threat landscape is evolving constantly, and attackers are increasingly well-prepared, looking for and leveraging new gaps and opportunities,” said Juan Andres Guerrero-Saade, senior security researcher, Global Research and Analysis Team, Kaspersky Lab. “This is why threat intelligence is so important: it arms organizations with understanding and reveals the actions they need to take. For example, the threat landscape in Q1 highlights the need for memory forensics and incident response to combat fileless malware attacks, and security that can detect anomalies across the network’s ongoing activity.”
The Kaspersky Lab Global Research and Analysis Team currently tracks more than a hundred threat actors and sophisticated malicious operations targeting commercial and government organizations in over 80 countries. During the first quarter of 2017, the company’s experts created 33 private reports for subscribers of its Intelligence Services, with Indicators of Compromise (IOC) data and YARA rules to assist in forensics and malware-hunting.
For more information please contact: intelreports@kaspersky.com
About Kaspersky Lab
Kaspersky Lab is a global cybersecurity company celebrating its 20 year anniversary in 2017. Kaspersky Lab’s deep threat intelligence and security expertise is constantly transforming into security solutions and services to protect businesses, critical infrastructure, governments and consumers around the globe. The company’s comprehensive security portfolio includes leading endpoint protection and a number of specialized security solutions and services to fight sophisticated and evolving digital threats. Over 400 million users are protected by Kaspersky Lab technologies and we help 270,000 corporate clients protect what matters most to them. Learn more at www.kaspersky.com.
For the latest in-depth information on security threat issues and trends, please visit:
Securelist | Information about Viruses, Hackers and Spam
Follow @Securelist on Twitter
Threatpost | The First Stop for Security News
Follow @Threatpost on Twitter
Media Contact
Sarah Kitsos
781.503.1836
