The tech lab of Frontline network and endpoint security provider, Sophos, has discovered how simple it is for cybercriminals to influence web robots a.k.a bots to locate weak targets and then devise a plan to mercilessly attack them.
The tech lab recently disclosed that these cybercriminals can launch several malicious codes to servers that fail to catch up with regular update cycles.
And on the other hand, the company recently upgraded its detective solution, Intercept X for Server by including endpoint detection and response, EDR.
With the addition of endpoint detection and response, Chief Product Officer, Sophos, Dan Schiappa, revealed that IT managers can now engage in a proper investigation of cyber attacks against servers, to safeguard the valuable data stored in them.
Dan said that cybercriminals regularly improve their sneaky methods and are currently mixing automation and human hacking skills to aid their success in any attack on every server of their choice.
The fresh kind of blended attack mixes the usage of bots to detect possible victims with active adversaries who decide who gets attacked and how.
However, the newest discovery allows IT managers at several companies of different sizes, visibility in a full estate. This lets them identify sneaky attacks, have a deeper understanding of the effect of a security breach and also help them to rapidly visualise the complete attack history.
Dan said, “When adversaries break into a network, they head straight for the server. Unfortunately, the mission-critical nature of servers restrains many organisations from making changes, often significantly delaying patch deployment.
“Cybercriminals are counting on this window of opportunity. If organisations do fall victim to an attack, they need to know the full context of what devices and servers were hit in order to improve security as well as answer questions based on stricter regulatory laws. Knowing this information accurately the first time can help businesses resolve issues much faster and prevent them from a repeat data breach.”
On how the cruel cyberattacks take place, his words, “Once the bots identify potential targets, cybercriminals use their savvy to select victims based on an organisation’s scope of sensitive data or intellectual property, ability to pay a large ransom or access to other servers and networks.
“The final steps are cerebral and manual: break-in, evade detection and move laterally to complete the mission. This could be to quietly sneak around to steal intelligence and exit unnoticed, disable backups and encrypt servers to demand high-roller ransoms or use servers as launch pads to attack other companies.
“Blended cyberattacks, once a page in the playbook of nation-state attackers, are now becoming regular practice for everyday cybercriminals because they are profitable. The difference is that nation-state attackers tend to persist inside networks for long lengths of time whereas common cybercriminals are after quick-hit money-making opportunities.
“Most malware is now automated, so it’s easy for attackers to find organizations with weak security postures, evaluate their payday poential, and use hand-to-keyboard hacking techniques to do as much damage as possible.”