6 emerging cyber-threats you didn’t see in the news

Justin Fier, Director of Cyber Intelligence | Monday October 24, 2016

As an industry, the constant stream of cyber-attacks in the news can be overwhelming. It seems like every day we see front-page headlines announcing defaced websites or massive data breaches.

But what about the attacks that never make the news?

Here at Darktrace, our worldwide deployments find early-stage threats every day. While these developing threats never make the headlines, they often emerge in fascinating and unexpected ways.

Here’s a selection of what we’ve found for our customers:

  1. An attacker hacked into a biometric fingerprint scanner used for physical access at a major manufacturing company.
    This company used network-connected fingerprint scanners, allowing the attacker to use Telnet connections and default credentials to gain access. There were strong indiciators that the attacker was able to use the device to breach other servers.
  2. A cyber-criminal gained access to a video conferencing system of a multi-national corporation.
    Using a backdoor Trojan Horse, the attacker used six external computers to collect data from the camera, presumably in an attempt to steal video from confidential meetings.
  3. A new strain of malware forced the computers of a security company to visit explicit websites.
    Using random, algorithmically-generated websites, the attackers tried to plant incriminating evidence on the network by generating illegal web activity.
  4. A threat-actor hacked a ‘Lost and Found’ computer at a major European airport.
    To gain entry, the attacker used DNS servers, an essential capability for internet communication though rarely used for information transfer.
  5. A hacker tried to compromise an industrial power network using default codes.
    After penetrating the SCADA energy network, the attacker tried to establish a remote control link by using access codes listed as factory defaults online.
  6. A phishing email launched a ransomware attack on a non-profit charity.
    Using a fake email, the attacker claimed to have an invoice from a legitimate supplier. The attached pdf contacted a server in Ukraine and downloaded malware attempting to encrypt the non-profit’s network.

Our ‘immune system’ technology caught each attack at an extremely early stage, giving us a rare look at how modern threats are able to bypass legacy systems. Traditional security solutions can only detect attacks with pre-determined signatures. But in each case, threat-actors used signature-less attacks to blend into the noise of the network.

By harnessing the power of unsupervised machine learning, the Enterprise Immune System learned ‘normal’ for each of these networks, and detected the threats as anomalous behavior. Our threat analysts then determined the nature of the attack and counseled the organization to take appropriate action.

If you’re interested in learning the full story behind these emerging cyber-threats, check out our Threat Use Cases page.

We look forward to sharing more of our industry insights with you in the future.

Blog Archive

Thursday January 10, 2019
Monday December 3, 2018
Thursday November 22, 2018
Thursday October 25, 2018
Thursday October 4, 2018
Monday August 20, 2018
Monday July 16, 2018
Friday June 22, 2018
Wednesday May 9, 2018
Monday April 16, 2018
Wednesday March 7, 2018
Tuesday February 13, 2018
Friday February 2, 2018
Monday January 22, 2018
Friday December 8, 2017
Monday November 27, 2017
Monday October 30, 2017
Wednesday October 25, 2017
Thursday October 12, 2017
Monday October 2, 2017
Monday September 18, 2017
Monday July 31, 2017
Thursday June 29, 2017
Wednesday June 21, 2017
Wednesday May 17, 2017
Monday May 8, 2017
Wednesday April 5, 2017
Monday March 6, 2017
Monday February 13, 2017
Monday January 30, 2017
Monday January 9, 2017
Friday December 16, 2016
Monday December 5, 2016
Friday November 18, 2016
Friday November 4, 2016
Monday October 24, 2016

About the authors

Justin Fier

Justin Fier is the Director for Cyber Intelligence & Analytics at Darktrace, based in Washington D.C. Justin is one of the US’s leading cyber intelligence experts, and his insights have been widely reported in leading media outlets, including Wall Street Journal, CNN, the Washington Post, and VICELAND. With over 10 years of experience in cyber defense, Justin has supported various elements in the US intelligence community, holding mission-critical security roles with Lockheed Martin, Northrop Grumman Mission Systems and Abraxas. Justin is also a highly-skilled technical specialist, and works with Darktrace’s strategic global customers on threat analysis, defensive cyber operations, protecting IoT, and machine learning.

Dave Palmer

Dave Palmer is the Director of Technology at Darktrace, overseeing the mathematics and engineering teams and project strategies. With over ten years of experience at the forefront of government intelligence operations, Palmer has worked across UK intelligence agencies GCHQ & MI5, where he delivered mission-critical infrastructure services, including the replacement and security of entire global networks, the development of operational internet capabilities and the management of critical disaster recovery incidents. He holds a first-class degree in Computer Science and Software Engineering from the University of Birmingham.

Andrew Tsonchev

Andrew advises Darktrace’s strategic Fortune 500 customers on advanced threat detection, machine learning and autonomous response. He has a technical background in threat analysis and research, and holds a first-class degree in physics from Oxford University and a first-class degree in philosophy from King’s College London. He was most recently featured on BBC World, BBC Morning and Al Jazeera to comment on the news regarding the GRU.

Max Heinemeyer

Max is a cyber security expert with over eight years’ experience in the field specializing in network monitoring and offensive security. At Darktrace, Max works with strategic customers to help them investigate and respond to threats as well as overseeing the cyber security analyst team in the Cambridge UK headquarters. Prior to his current role, Max led the Threat and Vulnerability Management department for Hewlett-Packard in Central Europe. He was a member of the German Chaos Computer Club, working as a white hat hacker in penetration testing and red teaming engagements. Max holds a MSc from the University of Duisburg-Essen and a BSc from the Cooperative State University Stuttgart in International Business Information Systems.