The availability of innovative DDoS attack tools and techniques has lowered the barrier of entry, which means an increase in the number of attackers launching DDoS attacks. Attack targets have also diversified. It used to be that finance, gaming, and e-commerce verticals were likely targets. Today, any organization, for any real or perceived offense or affiliation, can become a target of a DDoS attack. This while APT group and crimeware activity continues to grow, as actors in this space develop and unleash increasingly sophisticated attacks worldwide. Learn about: •Understand what is happening on the DDoS Landscape – the largest attacks and what is driving them •How Nation-State activity is going ‘internet-scale’ •Botnets, crimeware, intrusions – how these facets of the threat landscape tie in together

1. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. 1
NETSCOUT Threat Intelligence
Report
Powered by ATLAS
Findings from First Half 2018
Richard Hummel
Manager
Intelligence
Hardik Modi
Sr Director Threat
Intelligence

2. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. 2
Agenda
• Introducing NETSCOUT Threat Intelligence
• Key Findings
• Conclusion
• What is the NETSCOUT Threat Intelligence Report

3. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. 3
NETSCOUT Threat Intelligence
NETSCOUT
Threat
Intelligence
ATLAS
ASERT
Advanced Threat Level Analysis System
Arbor’s collective threat and traffic data depository that
includes traffic stats from over one third of the Internet.
Arbor’s unique correlation and analytics make it smart
data
ATLAS Security Engineering & Response
Team
NETSCOUT’s elite threat research organization that
analyzes and curates ATLAS data to provide human and
machine readable actionable intelligence to Arbor
customers

4. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. 4
Threat Intelligence Mission
Differentiation for
NETSCOUT’s
products and
services
Tactical and strategic
intelligence for
NETSCOUT’s
customer base
NETSCOUT’s
thought leadership
in security space

5. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. 5
ATLAS Quick Facts

6. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. 6
The New NETSCOUT Threat Intelligence Report
Summary of 1H 2018 Global DDoS attack
data from ATLAS and threat campaign activity
tracked by the ASERT research team. These
two entities comprise NETSCOUT Threat
Intelligence.
Consolidated view of threat landscape
and perspective of the team.
Live on August 7th via press, printed
at Black HAT
WHEN:
WHAT:
WHY:

7. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. 7
The New NETSCOUT Threat Intelligence Report
Extend credibility for NETSCOUT in the
security space
Demonstrate breadth of visibility and
research through ATLAS and ASERT
Prove coverage provided through AIF in
NETSCOUT and Arbor products
WHY:

8. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. 8
Key Findings
An Accelerating Internet Scale Threat Paradigm
• DDoS tactics being
used for internal
intrusions. Crimeware
and espionage adding
Internet Scale
techniques (worms,
botnets for mass
malware distribution)
• Big jump in
frequency of
very large DDoS
attacks since
Memcached.
• Countries and
verticals can
be highly
targeted.
• More nation
states adding
APT to their
statecraft.
APT

9. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. 9
DDoS attacks enter the terabit era
In Feb 2018, Memcached
vulnerabilities drove the largest
DDoS attacks seen to date
Vulnerable systems remain
available on the Internet
continuing to drive large attacks

10. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. 10
DDoS attack volume up, frequency down

11. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. 11
APT groups expand beyond traditional arenas
"Add cyber-attacks to their toolkit"
• Campaigns and frameworks are discovered for a
broad tier of nations
OilRig
(Iran)
Fancy
Bear
(Russia)
Hidden
Cobra (North
Korea)
Ocean
Lotus
(Vietnam)
Donot Team

12. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. 12
Crimeware actors diversify attack methods
Emotet Trickbot
Kardon
Loader
Panda
Banker
• Inspired by large-scale attacks in 2017, many
known crimeware families have included auto-
propagation (worm) techniques
– Emotet
– Trickbot
– IcedID
• There’s an increased focus on cryptocurrency
mining
• New platforms/affiliate programs like Kardon
Loader continue to emerge
• Banking trojans continually expand to new
regions eg. Panda Banker in Japan

13. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. 13
New DDoS vectors & tools are rapidly leveraged ...
• Memcached attacks went
from non-existent to
record-breaking in days
• Botnets like Mirai
incorporate new router
exploits routinely

14. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. 14
… While old ones get new life
"SSDP"
• SImple Service Discovery Protocol (SSDP), in
use since 2015, re-emerged in 2018 as a "new"
method.
• Netscout Threat Intelligence demonstrated the
use of SSDP in 2015, proving this was not a new
vecotor.
• However, we uncovered a new class of SSDP
abuse where vulnerable systems will respond to
SSDP on non-standard ports, resulting in a flood
of UDP packets with ephermeral source and
destination ports.
• Mitigation then becomes more difficult.

15. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. 15
Mirai Variants Emerge
• Mirai was first used to launch high-profile,
high-impact DDoS attacks in 2016
• Subsequently, source code was published
• This has spawned a series of generations that
introduce new functionality
• ‘Satori’ leveraged remote code injections
exploits for propagation
• OMG introduced HTTP/SOCKS proxy
• IoTrojan leveraged new router exploits
"IoT Threats Rapidly Expand"

16. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. 16
APT campaigns can involve internet-scale footprints
"Internet-scale & Supply Chain"
• ‘Internet Scale’ factors in their approach too –
NotPetya, WannaCry, BadRabbit are a few
examples
• Supply chain attacks are being seen more
frequently (CCleaner)
• Absolute Lojack recovery software for laptops is a
representative finding
• HiddenCobra (North Korea) uses DeltaCharlie
malware to launch DDoS attacks from botnets.

17. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. 17
Top Targeted Verticals
• Telecommunication
Providers observe the
overwhelming majority
of attacks – inherent to
their role
• Shifts in popular targets
relative to 2017
• ‘International Affairs’ in
7th spot
• Represents first vertical
analysis conducted on
ATLAS data

18. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. 18
Conclusion
Global threats will require new global
interventions
Threat Intelligence is key to informing
strategic direction for threat defense

19. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. 19
Conclusion
Available at https://www.netscout.com/threatreport
Next iteration is planned for January 2019

20. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. 20
Thank you
Questions?