TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

F5 Labs

Regional Threat Perspectives, Fall 2019: Asia

2019-12-19 · Read original ↗

ATT&CK techniques detected

7 predictions
T1071.001Web Protocols
84%
"europe. html ) and latin american threat landscapes ( / content / f5 - labs - v2 / en / labs / articles / threat - intelligence / regional - threat - perspectives - - fall - 2019 - - latin - america. html ), systems in asia received a considerable amount of attacks coming from in…"
T1071.001Web Protocols
80%
"7 asns, 6 of which are inside asia, that exclusively targeted systems in asia ( see asns denoted with * * * in figure 4 ). additionally, many networks targeting systems in asia were clearly launching exponentially more attacks against systems in the middle east ( / content / f5 -…"
T1046Network Service Discovery
48%
"june 2019, when the global campaign targeting rfb began, unlike ovh sas which has routinely shown up on top attacking network lists in our hunt for iot report series for years. gtech, the network in third position that is driving italy into the top position on the geographic sour…"
T1078Valid Accounts
45%
"august through october 2019 conclusion in general, the best approach a security team can take as defenders in this modern threat landscape is one of “ assume breach. ” this is not a fud ( fear, uncertainty, and doubt ) position, this is a realistic position backed up by the volum…"
T1046Network Service Discovery
43%
"october 2019. ip addresses attacking europe compared to other regions the following chart shows the volume of attack traffic european systems received per ip address in comparison to other regions of the world. attack traffic destined for european systems had some overlap with th…"
T1190Exploit Public-Facing Application
36%
"445, and the third most attacked port, ssh port 22, were commonly targeted across the world because exploiting a vulnerability on either of these services can give a malicious actor access to the entire system. top source traffic countries before we look at the top “ source traff…"
T1021.002SMB/Windows Admin Shares
30%
"a follow - up plan that included credential stuffing on rfb / vnc port 5900 and ssh port 22, http / s attacks on ports 443 and 8080, and spamming on smtp port 25. the following ip addresses launched attacks against rfb / vnc port 5900 all over the world : these port 5900 attacks …"

Summary

Attackers targeted applications and conducted credential stuffing attacks against systems in Asia during the fall of 2019.