ENISA Threat Landscape Report 2017: China is the largest DoS attacking country
Do Son 
The European Union Agency for Network and Information Security (ENISA) released “ENISA Threat Landscape Report 2017
15 Top Cyber-Threats and Trends” in January 2018, reminding business executives to beware of networks on the subject of cyber attacks.
ENISA stressed in the report:
- Phishing has been reported to be responsible for 90-95% of successful attacks worldwide. Through the use of
obfuscation, phishing mails manage to evade end-point detection. Of particular interest (because very
sophisticated) are CEO phishing mails/fraud. It is considered that the human link is still a weak link in the
phishing infection vector. It is imperative to increase awareness measures to increase user vigilance.
Besides phishing, attempts continue to spread malware by using the common attack vectors like
malvertising, spam emails, exploit kits, etc.- we consider the following threat agents’ groups: cyber-criminals, insiders, cyber-spies, hacktivists, cyber-offenders, cyber-fighters, cyber-terrorists and script-kiddies. It should be noted that the sequence of mentioning is according to their engagement in the threat landscape.
ENISA made several references to Russia and China in this report. The report mentions China, India, and Russia as the three “bot-infected countries,” where attackers send spam through automated accounts, spread malware, launch DoS attacks and perform other malicious activities. China is the largest DoS attacker, with 60% of DoS attacks coming from “China Hacker Corps” and 90% of DDoS targeting the U.S. entities. Attackers may employ groups of botnets on some Chinese websites, which may even show the number of attacks and the number of “broilers” online. Hackers may also rent “exploit kits” (EK, specifically looking for user-system security holes exist).
The report also mentions the three cyber espionage groups allegedly involved in China and Russia: the APT17389, the APT28387 and the APT29388, claiming that the three organizations are the most active and the most dangerous in 2017.
- APT17389 is a China-based threat group that has conducted network intrusions against U.S. government
entities, the defence industry, law firms, information technology companies, mining companies, and
non-government organisations. Researchers speculate that the CCCleaner attack was powered by a
nation-state actor, likely the Chinese APT17 group.- APT28387 (also known as, Fancy Bear, Pawn Storm, Sofacy Group, Sednit and STRONTIUM) is a cyberespionage group most probable sponsored by the Russian government. Recently, a new campaign was
uncovered being conducted by this group in early July, against multiple companies in the hospitality industry, including hotels in at least seven European countries and one Middle Eastern country.- APT29388 known also as Cozy Bear, is a Russian hacker group believed to be associated with Russian
intelligence. In 2017, it was identified that this group targeted a couple of public institutions from Norway: Ministry of Defence, Ministry of Foreign Affairs, and the Labour Party. Also, it was identified that Dutch ministries, including the Ministry of General Affairs, were targeted by this group in 2017.
Maria Gabriel, EU’s digital economy, and the social commissioner said that understanding the major cyber-security threats is crucial if the EU is to successfully secure cyberspace.
ENISA noted that Mac users are under constant attack in 2017; botnets on social networks are large and there are 350,000 fake accounts on Twitter; companies with massive amounts of personal data may be attacked. In addition, ENISA also mentioned in the report all kinds of major data breaches in the world.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
