CrowdStrike Report Reveals Cyber Intrusion Trends from Elite Team of Threat Hunters
Mid-year OverWatch report provides insights into growing intrusion trends; highlights top threats and targeted industries based on reviewing more than 25,000 attempted intrusions
Sunnyvale, CA — October 9, 2018 — CrowdStrike® Inc., the leader in cloud-delivered endpoint protection, today announced the release of its Observations From the Front Lines of Threat Hunting report. The report analyzed threat data from CrowdStrike Falcon OverWatch™, the company’s industry-leading managed threat hunting team that detects intrusions by sophisticated and stealthy adversaries, to reveal insights into attacker tactics, techniques and procedures (TTPs). The report also leveraged CrowdStrike’s industry-leading threat telemetry, which processes 1 trillion security events a week across 176 countries, to provide additional context into the 25,000 attempted intrusions that CrowdStrike OverWatch stops in a year. Overall, 48% of intrusion cases identified involved targeted intrusions from adversaries with a nation-state nexus, while 19% were conducted by eCrime actors.
According to the report, the technology, professional services, and hospitality sectors were targeted most often by cyber adversaries. The actors used a variety of novel tactics, demonstrating particular creativity and perseverance in defense-evasion and credential-access TTPs such as the use of Windows Internal tool, Active Directory Explorer, for one-time credential dumping. Notable percentages of intrusion cases by vertical include:
- Technology: 36%
- Professional Services: 17%
- Hospitality: 8%
- Defense and Federal: 7%
- Non-governmental Organizations: 7%
- Uptick in Chinese Targeting. OverWatch data identifies China as the most prolific nation-state threat actor during the first half of 2018. Data shows that Chinese adversaries have made targeted intrusion attempts against multiple sectors of the economy, including biotech, defense, mining, pharmaceutical, professional services, transportation, and more.
- eCrime Actors are Increasing Interest in Cryptocurrency Mining: OverWatch identified multiple intrusions against victims in the legal and insurance industries where criminal perpetrators gained privileged access to internal networks. In these cases, adversaries pursued post-exploitation financial gain by deploying cryptocurrency miners and employed techniques that allowed them to perform extensive lateral movement, creating as large a foothold as they could to commandeer resources for mining.
- Increased Targeting of the Biotechnology Industry. OverWatch observed continued targeted adversary interest in the biotechnology industry vertical, with industrial espionage likely being the motivation behind multiple attacks. The tactics observed usually occurred from adversaries looking to maintain an ongoing data collection effort against organizations in the sector.
- Continued Blurred Lines: A key theme noted in the CrowdStrike 2017 Global Threat Report was the blurring of lines between the TTPs of highly skilled nation-state adversaries and their criminally motivated counterparts. That trend continued as CrowdStrike saw less skilled criminal actors adopt more advanced TTPs used by well-known nation-state actors.
- Strive to detect a threat in 1 minute on average
- Investigate the detection in 10 minutes
- Remediate and contain the attack in 1 hour