Adapting to a new reality: threat landscape and cybersecurity challenges in 2020

Daily interaction with organizations that seek assistance with full-scale incident response helps Kaspersky’s Incident Response Team understand the latest cyberthreat trends. After analyzing data containment, digital forensics investigations and malware analysis, as well as helping to improve security processes following incidents, the team now has a great knowledge base with statistical data of recent incidents.

After this panel discussion with experts from different organizations, attendees will understand the latest trends in attack scenarios and the details of some of the most noteworthy cases they faced. This session will be of special interest to representatives of financial organizations, government agencies, and industrial bodies, as well as others.

Today's speakers:
• Chris Kubecka, CEO and Founder of HypaSEC, previously established security after Shamoon attack against Saudi Aramco in 2012 – will discuss how global corporates manage cyber risk and what should be changed in their approach to the incident response
• Ayman Shaaban, Digital Forensics and Incident Response Manager of Kaspersky Global Emergency Response Team (GERT) – will share his knowledge, based on his day-to-day experiences. He will present statistical analysis of recent incidents, the most frequent reasons why the Kaspersky incident response service was requested, and tools used in the attacks
• Dr. Serge Droz, Chair of the Board of directors of the Forum of Incident Response and Security Teams (FIRST) and seasoned incident responder working at Proton Technologies, will share his vision of global incident response as well as some interesting cases from his practice.

YARA is often called the “pattern matching Swiss knife for malware researchers and everyone else”, and for a good reason: YARA detection rules help find malware, exploits and 0-days that couldn’t be found by other methods.

How could YARA benefit you and your organization? What are the ingredients of a good YARA rule? How can you use YARA to find unknown threats and anomalies?

Join our online session with Costin Raiu, Director of Kaspersky’s Global Research an Analysis Team (GReAT) and Juan Andres Guerrero-Saade, Adjunct Professor of Strategic Studies, Johns Hopkins SAIS, and moderated by Dan Demeter, senior security researcher at Kaspersky’s GReAT – cybersecurity experts who have been using YARA more than 6 years— for their insights and tips on using it for threat hunting.

Held on September 3 at 2 PM GMT, the webinar will also include an exclusive preview by Yury Namestnikov, Head of GReAT EEMEA Research Center, of the new Kaspersky online self-study training ‘Hunt APTs with YARA like a GReAT Ninja’ which will launch in September. Armed with the knowledge, tools and YARA rules from this training, any IT security professional interested can study the Kaspersky Global Research & Analysis Team’s best practices on threat hunting with YARA. In addition to the practical insights from the company’s world-renowned cybersecurity experts, training includes access to a special virtual lab where learners can practice their new skills by working on 20+ threat hunting exercises – all based on Kaspersky’s exclusive research.

In this webinar you will be able to:
- Hear from cybersecurity experts their tips and insights on efficient threat hunting with YARA
- See a detailed demo of our renowned training and have a chance to win a free YARA training worth 1400 USD
- Tune into a threat hunting panel discussion

Learn more about Kaspersky’s online cybersecurity training on threat hunting with YARA: xtraining.kaspersky.com

On July 22 Kaspersky's Global Research and Analysis Team (GReAT) held its second talk of ‘GReAT Ideas. Powered by SAS’ series.

Watch the recording of the session if you missed it live.

‘GReAT Ideas’ will empower you with information about the threat landscape directly from the experts themselves. During the second edition of the series GReAT researchers focused on curious malware specimens and campaigns as well as the new cutting-edge tools and techniques that they have implemented in threat hunting and detection.

The agenda includes:
14:00Clearing the WellMess: a technical look at recent attacks by Brian Bartholomew
14:25Threat hunting in new kicks: using VirusTotal code similarity with KTAE by Ariel Jungheit
14:50Cloud Snooper – detecting a Linux rootkit at scale by Pierre Delcher
15:15GReAT thoughts: Awesome IDA Pro Plugins by Boris Larin
15:40Unmasking COVID-19 cyber-badness: content filtering at a worldwide level by Dmitry Bestuzhev and Fabio Assolini
16:00AMA session
16:30End of program

Learn more on Securelist.com

On July 16, the social media platform Twitter experienced one—if not the biggest—security breaches in its history when cybercriminals hacked into major public figures’ verified accounts and convinced users worldwide to transfer them nearly $120,000 in bitcoin.

While the exact details of how this breach happened may never be fully known, Twitter is not the first—nor will it be the last—to be faced with a hack. The more important question to ask here is how can these sorts of incidents be prevented in the future?

Join Kaspersky security researcher Dmitry Galov for a look at what lessons can be taken from the Twitter hack and what policies should factor into your company’s security program. Get ready to learn:
•The components of a strong cybersecurity program
•How to promote cybersecurity best practices among your employees
•Strategies for secure remote work
•Ways to prevent spear phishing attacks from being successful

A hack isn’t inevitable. Time to bolster your company’s security.

Kaspersky experts present their latest quarterly review of advanced persistent threat (APT) activity in 2020 in a new discussion format.

Costin Raiu, Vicente Diaz and David Emm will review and discuss the latest campaigns, tools and techniques deployed by established and emerging threat actors, and highlight some of the most significant events and shifts that have taken place across the cyberthreat landscape in the second quarter of the year.

During this webinar you will learn about:

• Which APT campaigns made their mark in Q2
• The new tools and techniques have been spotted
• The new developments and trends the security industry should expect
• The best way to protect users against emerging threats

Join the GReAT team on this webinar to find out about the most up-to-date news and participate in a Q&A session with leading cybersecurity experts.

Kaspersky experts present their review of spam and phishing activity in the first half of 2020.

Phishing emails remain one of the most common ways to infect user devices and 2020 has shown that this is still the case. But is there more to these content-related threats? What should employers be aware of?

Learn about what has happened over the first half of the year in the area of corporate spam and phishing, the new topics and techniques cybercriminals came up with and what new trends we should expect in the coming second half of the year.

During this webinar you will learn about:

∙ New ways phishers and spammers target organizations
∙ New topics and techniques used by cybercriminals in this area
∙ What risks phishing and spam may have on the targeted organization
∙ How to protect yourself and your employees from phishing and spam attacks

In June 2020, Kaspersky researchers uncovered a new technique for stealing users’ payment information on online shopping websites — a type of attack known as web skimming. Web skimming is a popular practice used by attackers to steal users’ credit card details from the payment pages of online stores, whereby attackers inject pieces of code into the source code of the website. This malicious code then collects the data inputted by visitors to the site (i.e. payment account logins or credit card numbers) and sends the harvested data to the address specified by attackers in the malicious code.

This time, cybercriminals invented a new technique, abusing the capabilities of Google Analytics. By registering for web analytics accounts and injecting these accounts’ tracking code into the websites’ source code, attackers can collect users’ credit card details. About two dozen online stores worldwide were compromised using this method.

In this webinar you will find out:

•How cybercriminals manage to gather personal details via the web analytics service
•Technical analysis of the new malware and its features
•Best practices to avoid such threats

Read the full report about the new threat on Securelist: https://securelist.com/web-skimming-with-google-analytics/97414/

Disclaimer: Kaspersky has informed Google of the problem, and they confirmed they have ongoing investments into resolving the issue.

Employees are a company's best asset and often considered to be the heart and soul of a business. In many respects, it depends on how they are managed that determines if staff will become the weak link or an entry point for cybercriminals to take advantage of, or if they are able to contribute to its prosperity and cyber-safety.

During this webinar you will learn:

- Why employees’ IT mistakes can ruin your business
- Why standard training and tip sheets do not work (and what you can do about this right now)
- How to teach employees about topics they may not necessarily be interested in. How than to turn this knowledge into permanent behavioral change, so your employees have positive cybersecurity habits
- Tutor in-a-box: an adaptive learning approach to fit every individual’s nature and needs

The META threat landscape: cyberthreats in the new reality
The world is changing every day and the cyberthreat landscape now fully reflects that. In this webinar, Amin Hasbini and Maher Yamout, security researchers from Kaspersky’s GReAT, will provide an overview of the latest cyberattacks in the META region and share their insights about the new threats to have affected the cybersecurity sector in the past month.

You will learn more about:
∙ Cybersecurity after several months of working remotely: what has changed and what still needs attention
∙ Coronavirus and the threat landscape in the META region
∙ Kaspersky’s latest private threat intelligence findings on the most recent incidents in the region

Get the inside scoop on GReAT, Kaspersky’s Global Research and Analysis team, which works on uncovering APTs, cyber-espionage campaigns, major malware, ransomware and underground cyber-criminal trends across the world.

‘GReAT Ideas. Powered by SAS’ is a series of talks held by GReAT and aimed at sharing their latest expertise on hot tech topics. Inspired by the regular team internal meet-ups, as well as by the Security Analyst Summit’s friendly atmosphere of exchanging knowledge, this series will empower you with information about the threat landscape, the most recent cases and techniques used in the cybersecurity world, directly from the experts themselves.

Here is what you will learn during this webinar:

Linking attacks to threat actors: case studies

In this talk, Kurt Baumgartner will examine recent APT alerts and discussions, and how to get the jump on how or why this malware is connected with past activity. In particular, we will start with 2020 Kwampirs and Lazarus reporting and present details on these malware techniques.

Threat hunting with Kaspersky’s new malware attribution engine

Kaspersky introduces a new malware attribution engine, which has evolved from an internal tool used by Kaspersky’s GReAT. This technology was already leveraged in the investigation of a number of renowned APT campaigns, such as TajMahal, ShadowHammer, ShadowPad and Dtrack. See how it works in a demo by Costin G. Raiu, the director of GReAT

Microcin-2020: GitLab programmers ban, async sockets and the sock

In this current campaign, the threat actor Microcin is still using steganography, keeping his interest in diplomatic entities, but has improved the last-stager in an interesting way. Learn about it directly from Denis Legezo, the researcher who analyzed it.

The next generation IoT honeypots

Kaspersky Honeypots Team will show you the techniques and new kicks in the next generation of honeypot infrastructure being developed by Kaspersky

Protecting corporate networks is challenging. Large organizations are attacked daily and more often than not, the speed at which you find threats entering the network is vital. Network Intrusion Detection Systems (NIDS) are key components that help protect the network perimeter and analyze network traffic. But how can they be used most effectively?


In this webinar Tatyana Shishkova, a security researcher at Kaspersky, who specializes in threat detection, will share her expertise and cover the following topics:

∙ What NIDS is, how it works and where to start
∙ What is possible with threat detection
∙ Best practices and Suricata rules
∙ NIDS limitations and possible workarounds

Technological progress, new devices and tools have evolved in the past 40 years, but how did the methods and targets actually change? What is new?

Watch a quick overview of how hacking has changed over the past decade, presented by David Jacoby, a security evangelist from Kaspersky’s GReAT, at #SASatHome, the online version of the renowned Security Analyst Summit, which took place on 28-30, April.

#SASatHome, the online version of a renowned Security Analyst Summit took place on 28-30, April. Watch one of the highlights of the event – the talk by Costin Raiu, the director of Kaspersky’s Global Research and Analysis Team (GReAT) dedicated to combining code similarity with YARA.

There is little doubt that YARA has changed the threat hunting game. According to Costin, this is for a couple of reasons, between them: it is easy to learn, easy to use and easy to deploy. Indeed, pretty much anyone can learn and start writing YARA rules! Thanks to platforms such as VTMIS, threat hunting with YARA can help uncover threats against your organization and greatly improve your defenses and awareness. Yet, while many can do strings, code-based YARA rules are somehow rare.

In this talk, we combine code similarity with YARA to live hunt for some fresh stuff. And while at it, we’ll be learning who is NN and why does he keep losing at Chess?

The connected world is under constant threat of cybercrime. As enterprises further their digital transformation, they need to constantly adapt to the rapidly evolving cyberthreat landscape, while weighing up cyber-risks against overall business goals and priorities. Staying ahead of cyberthreats is a race against time. Having the right people, technology and processes is no longer enough. Cybersecurity practices, like SOC and incident response, need to be augmented with timely, relevant, and actionable cyberthreat intelligence.

From informing strategic decisions to boosting incident containment and response, cyberthreat intelligence supports security leaders and practitioners in their mission to protect their businesses and support growth. Some key elements to that mission are:

- Informing executive management of the current threat landscape and demonstrating return on investment

- Shifting the enterprise security posture from reactive to proactive, and preventing breaches even before they occur, through seamless integration of technology, processes and data

- Having all relevant information in a single pane of glass to facilitate threat hunting and response, and contribute to incident management and prioritization activity

The Kaspersky and EclecticIQ collaboration on their portfolio of integrations guarantees high-end Cyber Threat Intelligence analysis, empowering organizations to stay ahead of cybercrime. Join us on a live webinar to learn more about the strength of our combined portfolio and offering, with a live product demonstration.

Have you ever wondered how Kaspersky discovered some of the world’s most famous APT attacks? Now, the answer is within your reach. Watch the latest recorded webinar by Costin Raiu, director of Kaspersky’s Global Research and Analysis Team (GReAT), who will be sharing best practices on the use of YARA, an essential tool for APT hunters that can assist with the discovery of new malware samples, exploits and zero-days, speed up incident response, and increase your defenses by deploying custom rules inside your organization.

If you ever wanted to master YARA and achieve a new level of knowledge in APT detection, mitigation and response, now is your chance.

This brief webinar is based on Kaspersky’s exclusive training on YARA rules, which has already helped improve the APT detection strategies of many cybersecurity teams from leading businesses across the world. During the webinar, you will learn how to write test and improve effective YARA rules. You will also get a glimpse of some of our internal tools and learn how to maximize your knowledge for building effective APT detection strategies with YARA.

This practical webinar is useful for security researchers and incident response personnel, malware analysts, security engineers, network security analysts, APT researchers and IT security staff. The content is suitable for both beginners and seasoned YARA users.

During this webinar, you will learn about:

•YARA syntax
•Tips & tricks for creating fast and effective rules
•Using YARA-generators
•Testing YARA rules for false positives
•Hunting new undetected samples
•Using external modules within YARA for effective hunting
•Anomaly search
•Real-life examples

Don’t miss this opportunity to learn about APT threat detection from Kaspersky’s Global Research and Analysis Team.

Attendees’ requirements:
Technical level: medium
Prerequisites: knowledge of basic programming languages
Software to install: YARA 3.11.0 or newer (if any)

Recently INTERPOL issued a warning about the increase of ransomware threat in the time of the pandemic. According to them, there is a significant increase in the number of attempted ransomware attacks against key organizations and infrastructure engaged in the virus response.

In fact, ransomware has been recognized as one of the most significant threats for businesses for a few years now, but not many actually know how profoundly it has developed over the past few years. As massive b2c ransomware campaigns ceased to be attractive, cyber criminals turned to those, who actually pay up – organizations.

In this webinar, Ivan Kwiatkowski, senior security researcher at Kaspersky’s Global Research and Analysis Team (GReAT) will explain how:

•the ransomware and cybercrime ecosystem is now structured
•the infection process in organizations takes place
•to secure your data and avoid falling victim to ransomware