ASERT Team

8.4 MILLION, that is the number of DDoS attacks NETSCOUT Threat Intelligence saw last year alone: more than 23,000 attacks per day, 16 every minute.

Executive Summary Dozens of known attack vectors ranging from obscure or little-used protocols (Citrix-ICA) to very common and vastly used protocols (DNS and NTP) give DDoS attackers a smorgasbord of available vectors to choose from. Some of these vectors are relatively new, such as ARMS, COAP, and WS-DD (as noted in...

A recent article, which NETSCOUT had the opportunity to participate in, highlights the importance the corporate world holds for Nation State APT adversaries. As the article duly notes, there used to be a handful of countries publicly named for acts of cyber espionage spanning across boarders. The reality today is that any nation can, and does, incorporate their own methods of cyber warfare. Ranging from simple spam messaging to sophisticated, custom malware capable of evading even the best anti-virus signatures in existence.

Executive Summary Airlines and the airport industry in general are highly lucrative targets for APT groups; they are rife with information that other countries would find useful. NETSCOUT data from 2019 shows airport and airline targeting remains strong and steady, with Russian, Chinese, and Iranian APT groups...

"It’s hard to express the scale of today’s cyber threat landscape, let alone its global impact." - Hardik Modi, Senior Director of Threat Intelligence Executive Summary In the past six months, there were nearly four million DDoS attacks around the world and that attack frequency grew by 39 percent in the first half of...

Executive Summary ASERT’s IoT honeypot network continuously monitors known exploit vectors and we recently detected a spike in exploit attempts targeting the Realtek SDK miniigd SOAP vulnerability in consumer-based routers from the end of April 2019 until the first half of May 2019. The attacks originated from Egypt...

In early March 2019, ASERT Researchers uncovered a credential harvesting campaign targeting mostly South Asian governments. The actors behind this campaign we call LUCKY ELEPHANT use doppelganger webpages to mimic legitimate entities such as foreign governments, telecommunications, and military.

NETSCOUT Threat Intellgience Report - Security Findings from Second Half 2018. Special Report powered by ATLAS.

Internet of Things (IoT) botnets commonly propagate by exploiting vulnerabilities in IoT devices. Telemetry from our IoT honeypots show the number of exploit attempts originating from bots continues to increase.

In May of last year, ASERT Researchers reported on LoJax, a double-agent leveraging legitimate software to phone home to malicious command and control (C2) servers. Since the publication of our research, we’ve monitored a number of new malware samples.

First discovered in May of 2018, Danabot is a Delphi written banking trojan that has been under active development throughout the year.

Internet of Things (IoT) botnet authors are adapting to a shift in more secure IoT devices, which has diverted attacker’s focus to exploiting vulnerabilities in IoT devices, either to supplement brute-forcing factory default passwords or completely supplant it.