Etay Maor is Senior Director, Security Strategy for Cato Networks, a developer of advanced cloud-native cybersecurity technologies.
The threat landscape continues to expand and become more dangerous as persistent threat actors constantly evolve and update their tactics, techniques and procedures (TTPs) to evade detection and succeed in their attacks. As the founding member of Cato Cyber Threats Research Lab, I’m proud to report our inaugural Q1 2024 research based on analyzing 1.26 trillion network flows for threats and suspicious activity collected from 2,200 SASE users (who blocked 21.45 billion cyberattacks). The report used the MITRE ATT&CK framework to detail attacker tactics, including the applications, protocols and tools running on these networks. Below are five major findings.
Attackers Favor Certain Sets Of TTPs Depending On The Industry
Judging by the exploitation of known vulnerabilities, attacker TTPs are common across all industries; however, certain industries appear to be more targeted by specific attack methods than others. For example, entertainment, telecommunications, mining and metals are being targeted with T1499 (Endpoint Denial of Service) attacks more than other sectors. In Services and Hospitality, threat actors use T1212 (Exploitation for Credential Access) tactics more than in other sectors. The education sector suffers more brute force attacks than other industries, while the healthcare sector leads in web application attacks and scanning activities.
Known Threats Are More Popular Than Zero-Day Threats
While the discovery of zero-day threats receives a lot of media attention, the research proves that threat actors are frequently targeting unpatched systems using known vulnerabilities and exploits instead of zero-day threats. For instance, even after three years of its discovery, Log4j (CVE-2021-44228) continues to register as one of the highest-practiced exploits. Another well-known attack found across 33% of user traffic targets the PHPUnit testing framework (CVE-2017-9841), which has been in circulation for more than seven years.
Attackers Hide In Benign-Looking Traffic
To camouflage their covert activities, threat actors are exploiting existing tools in the target environment. Cato researchers observed threat actors employing techniques such as LOLBAS (Living Off The Land Binaries, Scripts and Libraries) and LOTS (Living Off Trusted Sites) to remain undetected. The analysis also revealed that all industry verticals still rely on Link-Local Multicast Name Resolution (LLMNR) and NetBIOS, with NetBIOS being the most used. Using LLMNR and NetBIOS posed significant security risks, such as LLMNR poisoning, SMB Relay Attacks, Pass-the-Hash Attacks and others. With LLMNR poisoning, a malicious device sends a fake response to an LLMNR request, tricking the requesting device into connecting to the wrong computer. This can be used to steal data or redirect traffic.
Enterprises Overly Trust Their Internal Networks Communication
Most enterprises place implicit trust in their MPLS networks and WAN-bound (internal) network flows. A majority use insecure protocols (62% run HTTP, 54% run telnet and 46% run SMBv1 or v2) for their WAN-bound communications. Moreover, the HTTP traffic analysis clearly revealed that many organizations do not encrypt their WAN traffic. This means that if an adversary has established a presence inside the organization’s network, they can listen in on unencrypted communications, which may include credentials, further aiding them in making lateral movements.
AI-Related Commerce Is Surging In Underground Marketplaces
The Cato report sheds light on some interesting discussions on hacker forums. In one case, attackers were discussing how they could jailbreak ChatGTP to create custom SQLMap commands. In another, they discussed a real-time deepfake cloning service. Researchers also observed advertisements for generating fake documents, fake credentials and deepfake creation services. Some actors market their machine learning (ML) expertise and certain cybercrime groups are seeking to hire AI experts to help them design malicious GPT variants.
Five Security Recommendations
In line with the above findings, it is recommended that cybersecurity leaders assume these five actions.
1. Avoid using insecure protocols, as these make it easier for threat actors to exploit vulnerabilities and eavesdrop on information in transit.
2. Implement zero-trust principles and strategies to minimize the attack surface in the event credentials are stolen or compromised.
3. Deploy network vulnerability scanning to discover known and unpatched vulnerabilities as this can go far to improve the enterprise risk posture.
4. Avoid using LLMNR and NetBIOS and use local DNS servers. As mentioned earlier, both LLMNR and NetBIOS pose major security risks, and these can be easily mitigated by relying on local DNS servers.
5. Employ asset management to identify and map services, applications and third-party packages and to detect exploitable old services and applications. Once these are mapped and understood, security teams should immediately replace insecure protocols and remediate unpatched services across the entire IT estate.
While new TTPs are constantly being introduced by adversaries, complete threat visibility remains elusive and fragmented in enterprises due to the presence of multiple-point solutions that fail to provide a holistic security view. Remember, an attack comprises multiple TTPs, and each TTP is an opportunity to detect or block the incursion. If enterprises don’t adopt a platform that provides such a holistic view, it will be difficult to detect, analyze and monitor suspicious events and cyber activities.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
