The menace panorama is stuffed with shifting targets. Over time, in style instruments, techniques, and procedures change. Malicious methods fall out of vogue, solely to come back roaring again months, if not years, later. All of the whereas, safety practitioners monitor community site visitors and adapt their defenses to guard their customers and networks. Retaining on high of those developments is among the most difficult duties for any safety workforce.
One nice space to search for developments is in malicious DNS exercise. Nowadays virtually all malicious exercise requires an web connection to efficiently perform an assault. For instance, an attacker makes use of a backdoor to hook up with a distant system and ship it directions. Info stealers want a connection to malicious infrastructure to exfiltrate delicate knowledge. Ransomware teams want to have the ability to “flip the change” remotely to encrypt the sufferer’s methods.
In our newest report, Cyber Menace Developments Report: From Trojan Takeovers to Ransomware Roulette, we take the extraordinary quantity of malicious domains that Cisco sees and blocks—over 1 million each hour—and study it for malicious developments and patterns. This knowledge involves us due to the DNS-layer safety that’s obtainable in Cisco Umbrella and Cisco Safe Entry.
Let’s take a more in-depth take a look at how we carried out this analysis, a pair developments highlighted within the report, and what you are able to do to higher defend towards these threats.
How the DNS knowledge was analyzed for the report
To create a transparent image from such a big knowledge set, we seemed on the classes Umbrella applies to identified malicious domains. These Menace Kind classes are practical groupings of threats that use comparable methods of their assaults.
We examined an eight-month timeframe (August 2023–March 2024) and found out the month-to-month common quantity for every Menace Kind class. To look at the developments, we then calculated how a lot every month was above or under the typical quantity. This provides us a simplified take a look at how menace exercise adjustments over time.
That is the place patterns started to emerge from giant batches of malicious web site visitors, and the outcomes are fairly fascinating. As an example, we’ll take a look at the three most energetic menace kind classes discovered on this report.
Info Stealers
The menace class that noticed essentially the most exercise throughout the time-frame was data stealers. This comes as no shock, as it’s a class that features exfiltrating giant batches of paperwork and monitoring audio/video communications will generate a considerable amount of DNS site visitors.
An fascinating development seems right here— three months of above-average exercise, adopted by one month of below-average exercise. We speculate that these drops in exercise might be tied to assault teams processing the information they steal. When confronted with a mountain of paperwork and recordings to sift by means of, generally it is sensible to take a break to catch up.
Trojans vs Ransomware
Subsequent, let’s evaluate two seemingly disparate classes: Trojans and ransomware. Trojan exercise was highest to start with of our timeframe, then declined over time. This exercise doesn’t point out that using Trojans is falling out of favor however reasonably highlights the ebb-and-flow nature we regularly see within the menace panorama. When Trojan exercise declines, we regularly see different menace varieties rise.
In distinction to Trojan exercise, ransomware exercise seems to be trending within the different path. The primary few months of the time-frame noticed under common exercise, however then in January it jumped nicely above common and stayed that means.
Why may these two differing menace varieties be trending in reverse instructions? In lots of instances menace actors will make the most of Trojans to infiltrate and take over a community, after which as soon as they’ve gained ample management, deploy ransomware.
These are only a couple examples of developments from the Cyber Menace Developments Report. Within the report we cowl a number of further classes, together with some that observe comparable patterns to Trojans and ransomware.
Find out how to defend and monitor your personal community site visitors
An web connection is a major element of modern-day threats. So why not block that web connection to dam threats? By monitoring and controlling DNS queries, safety practitioners can typically establish and block malicious site visitors earlier than it reaches end-users gadgets. Some high-level options, lined in additional element within the report, embrace the next:
- Leveraging DNS Safety
- Defending Your Endpoints
- Implementing a Safety Protection Technique
Cisco has a novel vantage level right here. You’ll be able to’t defend what you’ll be able to’t see, and since we resolve a median of 715 billion every day DNS requests, we see extra threats, extra malware, and extra assaults than simply about every other safety vendor.
With over 30,000 clients already selecting Cisco as their trusted companion in DNS-layer safety, organizations could be assured that their customers will probably be higher protected by means of their ongoing hybrid work, cloud transformation, and distributed environments:
- Cisco Umbrella is a part of the Cisco Safety Service Edge (SSE) product household, powering safe web entry for all Cisco SSE options. Umbrella makes use of DNS to cease threats over all ports and protocols to cease malware earlier and stop callbacks to attackers if contaminated machines connect with our community.Tune in on June 26 to be taught extra at our Cisco Umbrella Stay Demo: Streamline cloud safety and embrace an SSE or SASE structure
- Cisco Safe Entry is the latest addition to our Safety Service Edge (SSE) product household, offering an prolonged set of safety capabilities, together with safe net gateway (SWG), cloud entry safety dealer (CASB), zero belief community entry (ZTNA), distant browser isolation (RBI), knowledge loss prevention (DLP), cloud malware detection, and extra.Register to attend one among our upcoming periods for a Cisco Safe Entry Stay Demo: A wiser solution to safe entry to the web, SaaS, and personal apps.
Be taught extra
Obtain the total report for extra key insights on the present menace panorama:
Cyber Menace Developments Report: From Trojan Takeovers to Ransomware Roulette
Be taught extra concerning the findings from the brand new Cyber Menace Developments report the place I’ll share additional insights on this analysis, in our webinar on June 20th, 2024: The Internet’s Most Needed – A Cyber Menace Pattern Briefing
We’d love to listen to what you assume. Ask a Query, Remark Beneath, and Keep Linked with Cisco Safety on social!
Cisco Safety Social Channels
Share:
