The global nature of advanced cyber attacks

FireEye released a report that provides insight into the global nature of malware communication activity related to sophisticated cyber attacks.

“The threat landscape has evolved, as cyber threats have outpaced traditional signature-based security defences, such as antivirus, and permeated around the world, enabling cybercriminals to easily evade detection and establish connections inside the perimeter of major organisations,” said FireEye CEO David DeWalt.

CnC servers are used heavily during the life cycle of an attack to maintain communication with an infected machine by way of callbacks, enabling the attacker to download and modify malware to evade detection, extract data, or expand an attack within a target organisation.

“The Advanced Cyber Attack Landscape” draws from blocking more than 12 million callback events from 184 countries logged by the FireEye platform across thousands of appliances during 2012. The FireEye platform is deployed behind firewalls, next-generation firewalls, intrusion prevention systems (IPS), anti-virus (AV), and other security gateways, representing the last line of defence against advanced attacks that bypass traditional signature-based security infrastructure.

Cyber attacks have become a global activity. Over the past year, callbacks were sent to 184 countries. FireEye found that CnC servers are hosted in 184 countries—a 41 percent increase when compared to the FireEye findings in 2010 with 130 countries.

Asia and Eastern Europe are attack hotspots. Looking at the average number of callbacks per company by country, the Asian nations of China, Korea, India, Japan, and Hong Kong accounted for 24 percent of global callbacks. Not far behind, the Eastern European countries of Russia, Poland, Romania, Ukraine, Kazhakstan, and Latvia comprised 22 percent.

Technology companies are highly targeted. Technology companies experienced the highest rate of callback activity associated with the next generation of cyber attacks. Technology companies are targeted for the theft of intellectual property, sabotage, or modification of source code to support further criminal initiatives.

The majority of APT callback activities are associated with APT tools that are made in China or that originated from Chinese hacker groups. By mapping the DNA of known APT malware families against callbacks, FireEye discovered that the majority of APT callback activities—89 percent—are associated with APT tools that are made in China or that originated from Chinese hacker groups. The main tool is Gh0st RAT.

The complete report is available here (registration required).