Article from June 2017
World Wide Risk Update
We are seeing a very advanced intrusion attempt and campaign going on on our website, systems and at some customers and friends (we also assume this is targeting multiple cyber security companies as well). It appears to be at the Nation-State level and very good tools and attempts are being used that are at the very least coordinated and thought out. We are currently collecting lots of data which is being collected and backed up for forensics later on. We are seeing IPs from US, India, China, Brasil, Russia, Germany, France in these attacks that are both IP based that target various specific apps and specific attack vectors. The campaign also includes AWS resources, MSNbot, Googlebot, Yandex and Baidu as well as what looks like coordinated Phishing attempts with multiple payloads as pdf, MSOffice files.
A trend can be seen to how the attackers first map out the target and search for about us and other details of the company members (we don’t publish our team and the listed address is not the actual company / for exactly this reason). We then see attempts to upload various payloads into areas not normally seen in other attacks an then coordinated phishing attempts that also leverage any and all social media and other online resources. Phishing attempts have picked up ever since we started to publish information on recent attacks and have been picking up over the last few days to much higher levels. Many phishing attempts are flagged domains but some are new and fresh. Since most “cyber” security companies keep their suffered attacks secret, we assume this is either targeted at us or at a dedicated group of companies engaged in APT and Risk research. We encourage anyone to come forward with details of similar activities so that we can coordinate with the appropriate teams.
(Update with some more details)
Attacks that we have seen over 7 Days shows a picture of the following IP’s and Countries including nr of attempts:
When we however take a look at the last 24 hours, we see a very different picture:
|188.8.131.52||United States||United States||1|
|184.108.40.206||United States||United States||1|
|220.127.116.11||United States||United States||1|
|18.104.22.168||United States||United States||1|
|22.214.171.124||Russian Federation||Russian Federation||1|
We are currently tracking more than 3000 new and unique IPs involving various attacks on this website and other sensors are picking up similar traffic for WordPress sites that include some big names:
We are coordinating additives with Microsoft and currently tracking multiple IPs and collected traffic for forensics. We would like to thank in this case Microsoft Security for reaching out to us so that we can help protect any effected Microsoft customers that are currently using Azure, Outlook, Office 365, etc. (Thanks Guys and Gals!)
What can you do?
We have a few things, this data highlights the reason why we talk about Risk Intelligence all the time and proactive security teams as well as methodologies. We work on data that are indicators of (potential) threats so that teams don’t have to scramble during an attack to find needles in haystacks. We save time, money and a huge amount of costs by using our own dogfood (CyberNSight, NeedleStack -TM HDN2017).
We hope you enjoyed another post, we will do the next one on owning routers and permitter devices using a nice little tool that we found in our darknet searches.
Until the next time, you saw it here first at Hakdefnet!
(The info, intelligence and any data on this post or website are copyright and TM Hakdefnet 2017, no copying, pictures, etc without referencing us and giving us credit for the data and reports -Please)