The Emerging Cyberthreat Review with Nominum Data Science comes from the front lines of the war against cybercrime, analyzing the most prevalent and effective malware in today’s threat landscape – including DDoS, DNS amplification and pseudo random subdomain (PRSD) attacks.

1. Nominum Emerging Cyberthreat Review
1
Fall 2016

2. 2
15
trillionqueries analyzed
Time frame: 3/1/16-8/31/16 Avg unique domains from period 422.9 million

3. Threat landscape

4. 4
3. Top Malware Threats
- Overall – Necurs & Locky
- Mobile - Ghost Push
- IoT - Mirai
Key Findings
4. DNS DDoS returns
“PRSD” attacks resumed, targeting
popular domains
2. Millions of new domains daily
Five million new domains queried
every day (most are malicious)
1. Unprecedented IoT Attacks
Huge uptick since code release <
1 month

5. Threat Tracker
5
3X growth
in queries
and domains
82 million
malicious
queries daily
(by end of Aug)
94,000
domains added
daily to block list

6. Less than
one query
74%
More than
one query
26%
New domains in six month period
349.7 million
124.7 million
Domains in Six-Month Period

7. Top 2016 Threats

8. DDoS
8

9. Mirai
9
50,000
3 targets
Code released
September 30
5-6x increase

10. Locky and Necurs
10
Locky queries (weekly) Necurs botnet (bi-weekly)

11. Ghost Push Queries (bi-weekly)
11

12. Threat Locations

13. Top C&C Locations - World
13
1. United States
2. Canada
3. Germany
4. Brazil
5. China

14. Top C&C Locations – U.S.
14
1. California
2. Virginia
3. Arizona
4. Texas
5. Florida

15. Malware Hosting
15
Global U.S.

16. Diving into DDoS, Amplification
and Ransomware

17. PRSD Attacks in Past Two Years
17

18. 12 Minutes of a PRSD Attack
18

19. Amplification Queries
19

20. Expanding perimeter

21. Increasing complexity
IoTBYOD
93% of data
breaches take
minutes or seconds
yet only 20% of orgs
discovered them
within “days”
-Verizon
Timing

22. DNS protection
22

23. Threat aversion techniques

24. Data Science Algorithms

25. C&C Communication Blocking
C&C server
Can launch DDoS, steal
credentials, transfer $ from
online banking, etc.

26. Time to Block
26
Predicted DDoS Other Threats

27. Some Recommendations
 Invest in resilient DNS & monitor DNS carefully
 Partner with at least one secondary hosted authoritative DNS provider
 Don’t let a device you control go online without a secure password
 Prioritize identification & remediation of top threats (Necurs, Locky, Ghost Push)
 Invest in tools for rapidly identifying & stopping attacks from inside the network
 Make IoT security a priority!
27