Global leaders in technology laboratory and clinical security provider, Sophos, has swooped on new site attacking strategy by cybercriminals who now rely on web robots, simply known as bots to hit digitally unprotected systems especially financial sites of mega corporate.
In its latest report made available to Business Hilights, Sophos averred that relentless cybercriminals now have what it takes to launch wide range of malicious code to servers whose security updates are not regular.
However, to fight the new crime wave, the group said it has developed fresh detective solution, Intercept X for Server by adding endpoint detection and response, EDR.
By adding EDR to Intercept X for Server, Sophos says IT managers can investigate cyber attacks against servers, to protect high value data stored in systems.
Giving explanations on how it works, Chief Product Officer at Sophos, Dan Schiappa said, whereas cybercriminals frequently evolve methods which tend to blend automation and human hacking skills to successfully carry out attacks on servers, the newly detected class of blended attack combines the use of bots to identify potential victims with active adversaries making decisions about who and how to attack.
According to him, “The latest innovation allows IT managers at businesses of all sizes, visibility across an entire estate. This allows them to proactively detect stealthy attacks, better understand the impact of a security incident and quickly visualise the full attack history.
“When adversaries break into a network, they head straight for the server. Unfortunately, the mission critical nature of servers restrains many organisations from making changes, often significantly delaying patch deployment.
“Cybercriminals are counting on this window of opportunity. If organisations do fall victim to an attack, they need to know the full context of what devices and servers were hit in order to improve security as well as answer questions based on stricter regulatory laws. Knowing this information accurately the first time can help businesses resolve issues much faster and prevent them from a repeat data breach.”
He argued that if regulators rely on digital forensics as evidence of lost data, then businesses can rely on the same forensics to demonstrate their data has not been stolen.
While noting that “Sophos’ Intercept X for Server with EDR provides this required insight and security intelligence,” Schiappa, who explained how blended cyber attacks happen, disclosed that “Once the bots identify potential targets, cybercriminals use their savvy to select victims based on an organisation’s scope of sensitive data or intellectual property, ability to pay a large ransom, or access to other servers and networks.
“The final steps are cerebral and manual: break in, evade detection and move laterally to complete the mission. This could be to quietly sneak around to steal intelligence and exit unnoticed, disable backups and encrypt servers to demand high-roller ransoms, or use servers as launch pads to attack other companies.
“Blended cyberattacks, once a page in the playbook of nation state attackers, are now becoming regular practice for everyday cybercriminals because they are profitable. The difference is that nation state attackers tend to persist inside networks for long lengths of time whereas common cybercriminals are after quick-hit money-making opportunities.
“Most malware is now automated, so it’s easy for attackers to find organizations with weak security postures, evaluate their payday potential, and use hand-to-keyboard hacking techniques to do as much damage as possible,” Sophos digital security chief averred.
