New CrowdStrike Threat Hunting Report Reveals Dramatic Rise in eCrime Activity and Shift in Industries Targeted During Pandemic
Falcon OverWatch 2020 Mid-year report provides insights into massive uptick in intrusion activity and a sharp escalation in manufacturing sector targeting
Sunnyvale, CA – September 15, 2020 – CrowdStrike Inc. (Nasdaq: CRWD), a leader in cloud-delivered endpoint protection, today announced the release of the CrowdStrike Falcon® OverWatchTM 2020 Threat Hunting Report: Insights from the CrowdStrike OverWatch Team. The report is comprised of threat data from CrowdStrike Falcon OverWatch, CrowdStrike’s industry-leading managed threat hunting team, with contributions from CrowdStrike® Intelligence and Services teams. The annual report reviews intrusion trends during the first half of 2020 and provides insights into the current landscape of adversary tactics, which has been heavily impacted this year by the remote workforce environment of COVID-19. The report also includes recommendations for defending against the prevalent tools, techniques and procedures (TTPs) utilized by threat actors.
“Just like everything this year, the threat landscape has proven unpredictable and precarious as eCrime and state-sponsored actors have opportunistically taken aim at industries unable to escape the chaos of COVID-19, demonstrating clearly how cyber threat activity is intrinsically linked to global economic and geo-political forces,” said Jennifer Ayers, vice president of OverWatch and Security Response. “OverWatch threat hunting data demonstrates how adversaries are keenly attuned to their victim’s environment and ready to pivot to meet changing objectives or emerging opportunities. For this reason, organizations must implement a layered defense system that incorporates basic security hygiene, endpoint detection and response (EDR), expert threat hunting, strong passwords and employee education to properly defend their environments.”
Some of the notable report findings include:
- First half of 2020 hands-on-keyboard intrusion activity surpasses all of 2019: OverWatch observed an explosion in hands-on-keyboard intrusions in the first half of 2020 that has already surpassed the total seen throughout all of 2019. This significant increase is driven primarily by the continued acceleration of eCrime activity but has also been impacted by the effects of the pandemic, which presented an expanded attack surface as organizations rapidly adopted remote workforces and created opportunities for adversaries to exploit public fear through COVID-19 themed social engineering strategies.
- eCrime continues to increase in volume and reach: Sophisticated eCrime activity continues to outpace state-sponsored activity, an upward trend that OverWatch has witnessed over the past three years, accounting for over 80% of interactive intrusions. This does not indicate a reduction in nation-state activity, but rather reflects the extraordinary success threat actors have seen with targeted intrusions using ransomware and Ransomware-as-a-Service (RaaS) models, which have contributed to a proliferation of activity from a wider array of eCrime actors.
- Targeting of the manufacturing sector increases dramatically: There was a sharp escalation of activity in the manufacturing sector in the first half of 2020 in terms of both the quantity and sophistication of intrusions from both eCriminals and nation states, making it the second most targeted vertical observed by OverWatch. Healthcare and food and beverage also saw increased targeting, suggesting that adversaries have adjusted their targets to the shifting economic conditions resulting from the pandemic, focusing on industries made vulnerable by complex operating environments that experienced sudden changes in demand.
- China continues its aim at telecommunications companies: The telecommunications industry continues to be a popular target for the nation-states, specifically China. OverWatch observed six different China-based actors, whose motivations are likely associated with espionage and data theft objectives, conducting campaigns against telecommunications companies in the first half of the year.
CrowdStrike OverWatch comprises an elite team of cross-disciplinary specialists that provide deep and continuous human analysis on a 24/7 basis to relentlessly hunt for anomalous activity designed to evade other detection techniques. OverWatch harnesses the massive power of the CrowdStrike Threat Graph®, enriched with CrowdStrike threat intelligence, to track, investigate and advise on sophisticated threat activity. The cloud-scale telemetry of over 3 trillion endpoint-related events collected per week coupled with the detailed tradecraft on 140 adversary groups, provides OverWatch the unrivaled ability to quickly identify and stop the most advanced threats.
Looking forward to the remainder of 2020, OverWatch expects to see the continued brazen tactics of cybercriminals as they innovate and mature their processes to evade detection technologies and maximize their impact. To protect their data, organizations must implement a solution that secures a distributed workforce, is device-agnostic and is scalable. OverWatch’s skilled threat hunting with the robust data gathered by the Falcon platform provides users a transformative solution delivered via a single lightweight agent that is easily deployable regardless of an end user’s location, establishing a new standard in endpoint security.
For additional information, read a blog from the OverWatch team.
You can download a complimentary copy of the report here.
About CrowdStrike
CrowdStrike Inc. (Nasdaq: CRWD), a global cybersecurity leader, is redefining security for the cloud era with an endpoint protection platform built from the ground up to stop breaches. The CrowdStrike Falcon® platform’s single lightweight-agent architecture leverages cloud-scale artificial intelligence (AI) and offers real-time protection and visibility across the enterprise, preventing attacks on endpoints on or off the network. Powered by the proprietary CrowdStrike Threat Graph®, CrowdStrike Falcon® correlates over 3 trillion endpoint-related events per week in real time from across the globe, fueling one of the world’s most advanced data platforms for security.
With CrowdStrike, customers benefit from better protection, better performance and immediate time-to-value delivered by the cloud-native Falcon platform.
There’s only one thing to remember about CrowdStrike: We stop breaches.
Qualifying organizations can gain full access to Falcon Prevent™ by starting a free trial.
Learn more: https://www.crowdstrike.com/
© 2020 CrowdStrike, Inc. All rights reserved. CrowdStrike, the falcon logo, CrowdStrike Falcon® and CrowdStrike Threat Graph are marks owned by CrowdStrike, Inc. and registered with the United States Patent and Trademark Office, and in other countries. CrowdStrike owns other trademarks and service marks, and may use the brands of third parties to identify their products and services.
Contacts
CrowdStrike, Inc.
Ilina Cashiola, 202-340-0517
Ilina.cashiola@crowdstrike.com