Our lead malware researcher, Greg Sinclair, recently put together a nice high level summary of our Threat Research Group’s recent Elastic Botnet Report via an on-demand webinar. The webinar takes the listener through a summary of exploits of an ElasticSearch vulnerability used to create distributed denial-of-service (DDoS) botnet infrastructures using the Elknot and BillGates DDoS malware families. It includes an overview of the vulnerability, specifics about the threat actors, analysis of the malware functionality, and remediation steps to help detect and remove infections. It’s pretty interesting, so I thought I’d bring it to your attention. Also quite interesting was the original blog they…
Why the DoD Uses Advanced Network-traffic Analytics to Secure its Network: Series Introduction and Preview
This post is an introduction to a multi-part series that will explain how and why the Department of Defense has moved beyond automated alerting to defend its networks. According to the Ponemon study, “2014: A Year of Mega Breaches” published in January 2015:[clear-line] More than half of the most serious data breaches are not discovered until one year after the incident, and most of these are discovered accidentally. In nearly two-thirds of organizations, IT departments fail to stop the most serious breaches because attackers “evaded existing preventive security controls.” More than half of all senior management are now “extremely concerned”…
