{"id":15076,"date":"2015-06-30T16:34:43","date_gmt":"2015-06-30T16:34:43","guid":{"rendered":"http:\/\/kasperskydaily.com\/b2b\/?p=4129"},"modified":"2020-02-27T03:56:04","modified_gmt":"2020-02-26T16:56:04","slug":"apts-in-2014-and-2015-a-landslide-in-the-making","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com.au\/blog\/apts-in-2014-and-2015-a-landslide-in-the-making\/15076\/","title":{"rendered":"APTs in 2014 and 2015: a landslide in the making?"},"content":{"rendered":"<p>June is wrapping up this\u00a0week; we\u2019ve made it through half of 2015. Over the last year and a half quite a few new APT campaigns have been discovered, but\u00a0there is a glimpse of a potential landslide in the making with\u00a0two of them, both reported in 2015.<\/p>\n<p><strong>Let\u2019s look at the map <\/strong><\/p>\n<p>Let\u2019s\u00a0take a look at a visual tool dedicated to real-time monitoring of APTs \u2013 <a href=\"https:\/\/apt.securelist.com\/\" target=\"_blank\" rel=\"noopener\">\u201cTargeted Attacks Logbook\u201d<\/a>.<\/p>\n<p>This is an interactive map of APTs, and currently it looks more densely populated than it was last year. Even though most of the campaigns reported this year were actually discovered in 2014. Judge yourselves:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-4130\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/102\/2017\/05\/06020337\/apts2014-1024x503.png\" alt=\"apts2014\" width=\"1024\" height=\"503\"><\/p>\n<p style=\"text-align: center\">This is 2014 Logbook from our <a href=\"https:\/\/business.kaspersky.com\/the-distant-ships-under-the-horizon-kaspersky-lab-launches-apts-monitoring-tool\/3440\" target=\"_blank\" rel=\"noopener nofollow\">initial announcement<\/a>.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-4131\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/102\/2015\/06\/06020336\/apts2015-1024x505-1.png\" alt=\"apts2015\" width=\"1024\" height=\"505\"><\/p>\n<p style=\"text-align: center\">This is how it looks <a href=\"http:\/\/apt.securelist.com\" target=\"_blank\" rel=\"noopener\">today<\/a>.<\/p>\n<p>\u00a0<\/p>\n<p>The colors of the \u201cships\u201d are indicative of the number of the APT\u2019s victims. As we see, most of them are within green-cyan range, although Desert Falcons, publicized in the first quarter of 2015, might have snatched up to 5K of the targets.<\/p>\n<p>Aside from Falcons, there are just three other APTs identified in Q1, 2015:<\/p>\n<p><a href=\"https:\/\/securelist.com\/blog\/research\/68750\/equation-the-death-star-of-malware-galaxy\/\" target=\"_blank\" rel=\"noopener\"><strong>Equation APT<\/strong><\/a> \u2013 the \u201cmothership\u201d, \u201cDeath Star\u201d of APTs, a massive cyberespionage framework, probably as old as 12 years old (according to the latest data, first known sample is dated 2002, but it may be even older).<\/p>\n<p><a href=\"https:\/\/business.kaspersky.com\/the-great-bank-robbery-carbanak-apt\/3598\" target=\"_blank\" rel=\"noopener nofollow\"><strong>Carbanak<\/strong><\/a> \u2013 the first ever criminal APT, but most likely not the last one.<\/p>\n<p><a href=\"https:\/\/securelist.com\/blog\/research\/69114\/animals-in-the-apt-farm\/\" target=\"_blank\" rel=\"noopener\"><strong>Animal Farm<\/strong><\/a> \u2013 a french-speaking cyberespionage campaign, also quite old and massive, accounting for up to 5K victims.<\/p>\n<p>A few more have been publicized since the end of Q1 \u2013 such as Hellsing APT (that surfaced after its counter-attack on yet another threat actor \u2013 Naikon), CozyDuke, SpringDragon and Duqu 2 which happened to be directed right at us, \u201cKaspersky Lab\u201d :-)<\/p>\n<p>And then there was Grabit.<\/p>\n<p>At a glimpse, APTs are something that belongs entirely to that grey area of high (geo)politics: most of these campaigns, regardless of their size, are targeting large entities in an apparent attempt to gather intelligence of global importance from their targets. And these targets are mostly governmental organizations, embassies, as well as major players in various industries.<\/p>\n<p><strong>Then Carbanak and Grabit arrived<\/strong><\/p>\n<p>They are very different from each other, but they do have something in common: neither are playing by a book.<\/p>\n<p><a href=\"https:\/\/business.kaspersky.com\/the-great-bank-robbery-carbanak-apt\/3598\" target=\"_blank\" rel=\"noopener nofollow\"><strong>Carbanak<\/strong><\/a> is the first ever entirely criminal APT. It has nothing to do with politics; it\u2019s all about stealing money from banks, not extracting valuable data.<\/p>\n<p><a href=\"https:\/\/business.kaspersky.com\/grabit-an-smb-targeting-spy-campaign\/4015\" target=\"_blank\" rel=\"noopener nofollow\"><strong>Grabit<\/strong><\/a>, in turn, is an espionage campaign \u2013 it is, strictly speaking, not an APT, but has a purpose similar to that of APTs. And it targets almost exclusively small-to-medium businesses.<\/p>\n<p>Is there a line that can be drawn between these two points? Probably not, but these two campaigns create the grounds for predictions which are within\u00a0the same trend: commercialization and criminalization.<\/p>\n<p>Simply put, criminals start using APT approaches and techniques for simple illicit profit, gradually switching from the larger targets to the smaller (and softer) ones.<\/p>\n<p>It doesn\u2019t mean that cyberespionage APTs targeting large corporations are going away any time soon, but APT techniques are going to become a problem for a much wider range of businesses. Their nature and size won\u2019t matter much, in fact: criminals tend to be indiscriminate and unscrupulous about whom they attack as soon as there extractable money.<\/p>\n<p>All businesses are potentially targeted by these criminals, but none of them\u00a0<em>have <\/em>to fall victim to an attack of any kind, be that something sophisticated and targeted or indiscrete and occasional. Kaspersky Lab\u2019s <a href=\"https:\/\/www.kaspersky.com\/business-security\" target=\"_blank\" rel=\"noopener nofollow\">business products<\/a> are capable of protecting its users \u2013 the companies of any size, from a small office to a large enterprise, from the threats described above.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Quite a few new APT campaigns were discovered in the last year and a half. Here is a glimpse of a potential landslide in the making with two of them. <\/p>\n","protected":false},"author":209,"featured_media":15646,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1999,2994],"tags":[499,963,2310],"class_list":{"0":"post-15076","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-business","8":"category-smb","9":"tag-apt","10":"tag-carbanak","11":"tag-grabit"},"hreflang":[{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/apts-in-2014-and-2015-a-landslide-in-the-making\/15076\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/apts-in-2014-and-2015-a-landslide-in-the-making\/15076\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/apts-in-2014-and-2015-a-landslide-in-the-making\/8136\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/apts-in-2014-and-2015-a-landslide-in-the-making\/15076\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com.au\/blog\/tag\/apt\/","name":"APT"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/posts\/15076","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/users\/209"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/comments?post=15076"}],"version-history":[{"count":2,"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/posts\/15076\/revisions"}],"predecessor-version":[{"id":26717,"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/posts\/15076\/revisions\/26717"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/media\/15646"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/media?parent=15076"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/categories?post=15076"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/tags?post=15076"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}