TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

F5 Labs

Cyberthreats Targeting the United States, Winter 2019

2020-03-27 · Read original ↗

ATT&CK techniques detected

6 predictions
T1046Network Service Discovery
95%
"had lower traffic levels. top attacking ip addresses out of the top ip addresses attacking american systems, 30 percent targeted only systems in the united states. the top four ip addresses launched more than double the amount of attack traffic than any other ip address in the to…"
T1071.001Web Protocols
61%
"application protocols. in second position is amazon. com, which hosted six of the top 50 attacking ip addresses. distributing traffic over a number of ip addresses is done in an attempt to hide malicious traffic within regular web traffic and takes more resources ( systems and hu…"
T1071.001Web Protocols
58%
"5900 targeting we saw starting in the summer of 2019, which we are still actively investigating. italy, singapore, the united states, and the netherlands round out the top five for sources of global attack traffic. the full top 10 source traffic countries attacked all regions of …"
T1598Phishing for Information
54%
"employees know how systems and data are targeted, and specifically how they are targeted with phishing attacks that can lead to credential theft, malware, and breaches."
T1071.001Web Protocols
54%
"and one on a number of ports focused on web application protocols. the united states in second position is also notable. we cannot attribute this attack traffic to malicious actors inside the united states due to proxy and vpn usage, but the data shows that malicious actors know …"
T1071.001Web Protocols
53%
"attacks, we are also noticing a large amount of attack traffic in the united states directed toward databases and other web application protocols. table 1. top attacking ip addresses and their attack types targeting u. s. systems, october 1, 2019 – december 31, 2019 uniquely targ…"

Summary

The attack landscape targeting US systems was characterized by a large amount of traffic directed at web applications and web app databases.