M-Trends 2019

1. M-Trends 2019 Trends From the Front Lines of Today’s Cyber Attacks Dan Faltisco Consulting Systems Engineer

2. Agenda • Who we are and how we gather this information • Trends from the front lines • Threat Actor Profiles – newly identified threat actor groups • Lessons Learned • Q&A

3. Case studies and examples are drawn from our experiences and activities working for a variety of customers, and do not represent our work for any one customer or set of customers. Efforts have been taken to obscure the identity of our customers and individuals associated with our customers in this presentation. 

4. On the Front Lines. Every Day. 700+ THREAT RESEARCHERS, PLATFORM ENGINEERS, MALWARE ANALYSTS, INTELLIGENCE ANALYSTS, AND INVESTIGATORS THOUSANDS OF INCIDENT RESPONSE HOURS EACH YEAR 4 CYBER THREAT OPERATIONS CENTERS WORLDWIDE 600K – 1M MALWARE SAMPLES COLLECTED DAILY FROM 70+ SOURCES 24,000 INTELLIGENCE REPORTS PUBLISHED IN 2018 35+ NATION-STATE SPONSORED APTs TRACKED

5. M-Trends: Tracking our investigative experience Annual publication sought after by security professionals and market analysts Data based on 12 months of forensic investigative findings (10/01/17 – 09/30/18) 10th anniversary Informing the cyber security community since 2010

6. Who’s a Target?

7. Global Median Dwell Time Dwell Time is calculated as the number of days an attacker is present on a victim network, from first evidence of compromise to detection.

8. Dwell Time Trending Dwell Time by Detection Source

9. Once a Target, Always a Target

10. Threat Actor Profiles Newly Named Groups in 2018/19

11. A Few Notes Before we Begin • Our Methodology • APT vs. FIN vs. TEMP • How do we know?

12. Newly Named APT Groups

13. Newly Named APT Group – APT37 • North Korean threat group • Known as Reaper • Primary regional targets: • South Korea • Japan • Vietnam • Middle East • Primary industry targets: • Chemicals • Electronics • Manufacturing • Aerospace • Automotive • Healthcare • Foreign corporations • Demonstrated willingness to use its cyber capabilities to achieve goals without regard for international norms FEBRUARY 19, 2018

14. Newly Named APT Group – APT38 • North Korean threat group • Primarily target financial industry in economically developing regions • Execute sophisticated bank heists featuring: • Long planning • Access to victim environment for prolonged period of time • Ability to operate across mixed operating systems OCTOBER 2, 2018

15. Newly Named APT Group – APT39 • Iranian threat group • Primarily regional target – Middle East • Primary industry targets • Telecomm • Travel • High Tech • Activity seems to suggest surveillance of political targets as primary function FEBRUARY 19, 2018

16. Newly Named APT Group – APT40 • Chinese threat group • Primarily regional target – SE Asia, USA • Primary industry targets • Maritime • Defense • Aviation • Chemicals • Research • Education • Government • High Tech • Moderately sophisticated, demonstrates access to significant development resources, as well as the ability to leverage shared and publicly available tools DECEMEBER 19, 2018

17. Newly Named APT Group – APT 41 • Chinese threat group • Wide Variety of Geographical Targets: • Europe, India, Japan, USA • Primary industry targets • Healthcare • High Tech • Video Game • Media • Telecoms • Virtual Currencies • Primarily Focused on Espionage operations, moonlighting as financially motivated targeting gaming companies and manipulating virtual currencies. August 7, 2019

18. Lessons (Re)Learned

19. Lessons (re)Learned in 2018

20. Defense Trends – Premediation Premediation: noun. Proactively implementing common remediation-focused initiatives General Posturing • Visibility and detection • Asset management • Enterprise password resets • Network segmentation Active Directory Hardening • Forest architecture and trusts • Operational Processes and Monitoring

21. Defense Trends – Premediation Privileged Account Management • Tiered Architecture Model • Jump Boxes / PAWS • MFA • GPOs to restrict Privileged Account Usage • Protected Users Group • Separate VPN Profiles for Admins Endpoint Hardening • Office hardening • System to system communication restriction • User privileges • Built-in local admin account password randomization

22. Defense Trends – Programmatic Enhancements Common mistakes in enterprise investigations: • Destruction of evidence • Insufficient investigation/escalation -> Prolonged dwell times • Poorly timed/failed eradication actions Recommendations: • Conduct regular review of IRPs, Use Cases, and Playbooks • Ensure processes account for evidence preservation • Understand context of identified threats and escalate • Incorporate concept of eradication timing

23. Questions?

24. Thank You