Sophos, a network and endpoint security firm has announced Intercept X for Server with Endpoint Detection and Response (EDR). By adding EDR to Intercept X for server, information technology (IT) managers can investigate cyber attacks against servers, a sought-after target due to the high value of data stored there.
According to the company, cybercriminals frequently evolve their methods and are now blending automation and human hacking skills to successfully carry out attacks on servers.
This new type of blended attack combines the use of bots to identify potential victims with active adversaries making decisions about who and how to attack, the company said in a statement.
According to the company, the recent SophosLabs Uncut report on how worms deliver cryptomining Malware to web servers, underscores how easy it is for cybercriminals to leverage bots to discover soft targets. The report explains an automated attack that can deliver a wide range of malicious code to servers that, as a class, tend to lag behind normal update cycles.
About the anatomy of a blended cyberattacks, the report added that once the bots identify potential targets, cybercriminals use their savvy to select victims based on an organisation’s scope of sensitive data or intellectual property, ability to pay a large ransom, or access to other servers and networks.
“The final steps are cerebral and manual: break in, evade detection and move laterally to complete the mission. This could be to quietly sneak around to steal intelligence and exit unnoticed, disable backups and encrypt servers to demand high-roller ransoms, or use servers as launch pads to attack other companies,” the report added.
Analysing the report, the Chief Product Officer at Sophos, Dan Schiappa, said: “With blended cyberattacks, once a page in the playbook of nation state attackers is established, others become a regular practice for everyday cybercriminals because they are profitable. The difference is that nation state attackers tend to persist inside networks for long lengths of time whereas common cybercriminals are after quick-hit money making opportunities.”
