Kaspersky for BusinessReality vs Delusion:
A Guide to the Modern
Threat Landscapewww.kaspersky.com#truecybersecurity

Reality vs Delusion: A Guide to the Modern
Threat LandscapeThe next generationof threats: is there sucha thing?

But.
But for the end user, in an evolving IT environment
with more and more to lose, experiencing a sudden
burst of pressure from the attackers’ side can feel likea dragon dropping out of seemingly clear sky. After
spending years in blissful ignorance, being hit only
by occasional malware infestations, businesses are
realizing that suddenly they’ve become cash cows forvery active cybercriminal entrepreneurs – who haveno intention of leaving them alone, ever. So, for them
‘Next Gen threats’ feel very real.

The never-ending war between hackers andcybersecurity vendors is a fine illustration of
the “survival of the fittest” principle. The leading
developers of defensive solutions are dead serious
in their resolution to stop attackers in their tracks –and, until recently, were demonstrating considerable
success. But this sort of pressure has also been a great
stimulus to hackers inventing new tricks, techniques
and business models, just in order to stay in business.

Malware / trojan / viruses

This Darwinian burst of evolution has provoked
an interesting bidirectional progression, one
direction being towards simplicity and the othertowards focused sophistication. The effect of bothprogressions is a growing complexity in the threat
landscape. To succeed against this requires levels of
inventiveness, resources and experience that only a
few market participants, those who are truly worthy ofthe ‘next gen security vendor’ title, possess.

57%

Phishing / social engineering

50%

Crypto-malware / ransomware

50%

Targeted attack

49%

The TOP4 IT Security concerns for businesses globally are about
direct threats1

So, when somebody asks: “Is there such a thing
as next generation threats?”– the answer is never
simple. These threats may be not new, but they are
powerful, hard to block and definitely may requireconsiderable skill and experience and dedication fromthe vendors providing protective solutions. And thedepth and breadth of underlying threat intelligence isof the utmost importance here, seamlessly fused withthe technologies running on both customers’ andvendors’ premises.

Does that mean that ‘next generation threats’ have
now arrived and are now threatening (forgive theunintended pun) businesses and private users alike?
The answer is yes and no.
For IT security professionals, the answer is, naturally,
negative.

Some readers may well be quick to assume that the
new Next Gen AVs are what’s needed to battle thisnew onslaught. Unfortunately, as in most things,
rushing to conclusions is a bad idea. One reason isthat, given the diversity of these ‘next gen’ threats,
protective approaches need to demonstrate at least
equal diversity. Which means true multi-layered
cybersecurity, capable of protecting from ALL threats,coming from every angle, rather than just thosecurrently fancied by the most active attackers.

There is no catastrophic leap in hacking techniques thatwould imbue the attackers with godlike power against
any given security system. Some of them were tried
many years ago – but somehow were only marginallysuccessful, often due to the technological restrictionsof the global IT environment at the time. Now, with the
IT firmament shifting into the right position, they havesuddenly flourished, giving attackers a considerable
edge against many existing solutions.

Unfortunately, the need for reliable protection fromthe broadest range of threats is all too often left out ofthe ‘next gen’ vendor’s scope for the sake of simplicity
and a lighter toll on system resources. As independent
tests have proved, only too well.

Then again, some defensive systems are holding
their ground much better than others, their vendors
constantly watchful for their adversaries’ latest
tricks and deploying whole arsenals of brand-new
countermeasures without their customers evenbeing aware. For the customer, everything feels quite
natural: no vendor wants the complications andcosts of introducing some new technology with its
own interface that forces customer usage patterns
to change, if the same technology can be delivered
silently and transparently, ensuring the Best Possible
Outcome for the customer.

In the meantime, the market leaders, such as
Kaspersky Lab, are keenly aware of these threats’
diversity and sophistication and usually offer multiple
1 Source: Global Corporate IT Security Risks Survey ‘2016 by B2BInternational & Kaspersky Lab

1techniques to protect from each of them. We also
recognize the critical importance of in-depth testing
using the most lifelike scenarios. Participating
regularly and enthusiastically in every possible
independent test helps us perfect our protective
layers, as well as deliver proof of trustworthiness of
our claims.

opposite. Even ‘script kiddies’ can now obtain accessto much more advanced malware than they werepreviously able to employ. And, when used by real
specialists (and there are quite a few in the hacking
community), the latest developments can really
become something to be reckoned with.
In addition, some techniques previously considered
the prerogative of targeted attackers, are increasingly
being adopted for mass infection campaigns (which
can transform themselves into something moretargeted at any time).

The Anonymity Veil
Perhaps one of the most important developments
behind the recent tectonic shift in the threat landscapeis increased anonymity. The emergence of Bitcoin andother crypto currencies has allowed for untraceable
payments to be made, and anonymity mesh networks,
such as Tor, offer new opportunities for the Black Hat
hackers to communicate and trade both informationand technologies without running great risk of
exposure. While the most seasoned cybercriminals still
form tight communities operating ‘ by invitation only’,
they nevertheless embrace the extra benefits provided
by these newer techs – and some cybercriminal
business models, such as ransomware (which wasnamed the third most concerning ITsec problem
globally2) have actually skyrocketed.

This brings us back to what is truly ‘next gen’ about
today’s threats.

The Bidirectional Progressof Threats
The Trend Towards Simplicity
Taking cost efficiency as the leading principle, thistrend is about simplicity in both development efforts
and conducting the attacks themselves. For thedevelopers, using off-the-shelf malware, tailoring
it only marginally and relying on their victims’lack of proper security measures has generated aconsiderable success rate. So there really is no need todevelop malware from scratch, when older software
can be just as efficient. Simple!

Ransomware
While not representing any particular technology,
this phenomenon is nevertheless one of the mosttruly ‘NextGen’ threats we currently face. When

The other area of simplification is about the marketingof malware offering convenient business models
for the less skilled and patient cybercriminals tobenefit from. Selling services rather than just tradingin malware apps, or wrapping them into convenientinterfaces and offering detailed FAQs and user
support, has all resulted in a drastic expansion of the“hackers’ bazaar”, drawing in large numbers of ‘script
kiddie’ hackers and other dilettantes. Naturally, theoverall quantity of cyberattacks has increased as aresult, greatly adding to the pressure experienced bybusinesses.

Rated 3rd
most worrying
attack scenario!

The Trend towards Sophistication

2

But all these new simplified business models don’tmean a lack of technological progression in tools andtechniques used by cyber attackers today: quite the2 B2B International, May 2016

2

1

3

trying to describe what ransomware really is, whatcomes to mind is that it’s a ‘cybercriminal businessmodel’. Technologically, it’s backed not only by awide range of attacking tools and techniques, butalso by a number of anonymization measures. The
emergence of cryptocurrencies and mesh networks(Tor, I2P etc.) allows criminals to receive payments
while staying incognito, and this has triggered thecurrent wave of ransomware, the biggest ever. If
not addressed properly, ransomware can ruin yourday in a most direct, destructive manner – with thechances of reversing its effects being extremely low.
In the meantime, according to statistics, one of fivevictims who pay the ransom still can’t decrypt theirfiles – while supporting the culprits financially only
stimulates the next wave of ransomware.

made into some already running process, and, fromthis moment on, the malware can function without
ever touching the file system, including loading
and launching extra modules and starting to movehorizontally within the affected infrastructure.

Different strains of ransomware can use different
attack technologies and infection methods, so
it’s important to have multi-layered solutions
equipped with specialized anti-ransomware
technologies guarding your whole system. For
example, our Kaspersky Endpoint Security for
Business provides an anti-cryptor rollback systemthat would block the malware and then revert
any files it already managed to encrypt to theirprevious state. Kaspersky Security for File Servers
and Kaspersky Security for Storage feature
another, complementary anti-cryptor engine thatblocks encryption processes initiated througha different host on the network. And, for thoseusing other vendors’ solutions, the standalone(and free) Kaspersky Anti-Ransomware Tool can
provide you with basic protection. The technology
this free tool is based on is actually the same as
is included in Kaspersky Endpoint Security – butthere in our own solutions it’s reinforced by many
additional protection layers not included in the free
application.

To detect a plethora of advanced malware types,
including memory-only malware, Kaspersky
Endpoint Security features System Watcher, atechnology based on the detection of suspicious
app behavior, surveying activities within a given
system. In this approach, it doesn’t matter whether
there’s a file body behind the process undersurveillance; any malicious activity will be blocked.
System Watcher’s detection principles are based oncontinuously running Machine Learning processes.
They leverage extensive threat intelligence obtained
through Kaspersky Security Network’s Data Sciencepowered processing of globally obtained statistics.

Powershell: legaltranslator, illegal activities

Memory-only malware

Shell script files were long perceived as somethingharmless – though of course, when used creatively
and with malicious intent, they are no such thing. But
Powershell scripts are something else again – because
they are truly powerful, offering an extremely wide
range of opportunities for attackers. Downloading
additional modules from the internet, running bodilessmalware, performing the remote execution of arbitrarycode on other machines in the network – and all
this in the name of an inherently beneficial app, thePowershell interpreter, standard Windows equipment
since Windows 7. Among the most notorious users of
this particular technique are the infamous champion
bank robbers from the Carbanak cybercriminal group.

The fact that most malware comes in the convenient
form of regular files fully justifies the importance of
file-based detection. The lion’s share of all the preexecution detection takes place at this level. And, ofcourse, this is not limited to simple narrow-sighted
signatures: all kinds of heuristics, including structure
and code-based analyses enable the detection even ofpreviously unknown malware. But if malware operates
outside the file system, this wealth of featuressuddenly becomes less useful. File artifacts can also
provide a treasure trove of information for digitalforensics. With all this in mind, attackers increasingly
make use of ‘memory-only’ approaches, especiallyin targeted attacks. This can be achieved throughdifferent means, including the use of ‘watering hole’
infection techniques or by opening a (well-obfuscatedin order to avoid premature detection) file attachment.
The outcome is the same in each case: an injection isKaspersky Lab is fully aware of this Powershellmalware wave – as well as the use of regular shell
scripts for malicious purposes. The strings passed toour engines are analyzed carefully, and execution isblocked should anything malicious be found.
3

The Mobile

Which means they are already understood, and themeans of protection against them is available fromleading vendors such as Kaspersky Lab, at this very
moment. And, with our HuMachine approach – anefficient fusion of threat intelligence acquisition, data
science amplified by machine learning processes anda world-famous team of experts – our customers canbe sure of the Best Possible Outcome. However ‘next
gen’ tomorrow’s threats become, they will always be
exposed and effectively countered by equally ‘next
gen’ protection techniques. This is an important partof our vision of True Cybersecurity.

Mobile phones and tablet computers are alreadythe preferred means of accessing the internet. By
the end of 2016, the number of smartphones usedworldwide will have reached 2.1 billion: a rich cropfor harvesting. Mobiles have already become deeply
integrated into corporate business processes and dataflows – but not always, unfortunately, into corporatecybersecurity infrastructures. Many factors, including
rising geopolitical tensions, the growing popularity ofmobile financial management and the sheer volumeof sensitive data currently kept on these devices, alllead to the expectation that a burst of attacks against
the mobile is on its way. The use of zero-day exploits
for mobile cyberespionage is a reality, but even lesssophisticated means can be very successful, especiallywhen unexpected. One good example is a shamelessmalvertizing attack, when a banking Trojan was
downloaded immediately after loading popular sites
fitted with a particular ad network block containing a
malicious JavaScript. The fact that the vast majorityof Android smartphones are rootable without much
hassle (including by fake/malicious apps), and somedevices even arrive with malware pre-installed,means that system-level malware living beneath theuser-controllable OS layer is not that uncommon.

Expertanalysis

HuMachine®

Kaspersky Mobile Security for Business possesses
a range of detection layers comparable to thatof many desktop solutions; it’s probably worth
mentioning that some of them are powered by
Machine Learning, leveraging the full power of our
HuMachine intelligence. It also features additional
powerful security layers such as Application Control.
It is important that Mobile Security acts as a partof a single whole, together with Mobile Device
Management and Mobile Application Management.
Such an approach helps businesses create solid andespecially secure mobility strategy.

MachineLearning

Conclusion
The list of techniques described above, though by nomeans comprehensive, is a fine illustration of levels of
ingenuity, which only seasoned human professionals
could hope to achieve. Perhaps they sow the seeds ofincreasing Fear, Uncertainty and Doubt in you, dear
reader, so we need to remind you of several things
right now, to dispel those fears.
First, once again, there’s nothing fantastically new
in these tricks. The most ‘NextGen’ development, infact, is the means for untraceable communication andpayment, such as Bitcoin and Tor-like networks. Eventhese have their roots in the more distant past, and are
not inherently malicious themselves; double-edged
blades used by cybercriminals for malicious purposesin the same way as many other legitimate tools.
4

Big Data /Threat IntelligenceKaspersky Lab, Moscow, Russia www.kaspersky.com
All about Internet security: www.securelist.com
Find a partner near you: www.kaspersky.com/buyoffline

Expertanalysis

HuMachine®

www.kaspersky.com© 2018 Kaspersky Lab. All rights reserved. Registered trademarks and service
marks are the property of their respective owners.

MachineLearning

Big Data /Threat Intelligence