チェック・ポイントサイバー攻撃トレンド2017年下半期レポート

Size: px

Start display at page:

Download "チェック・ポイントサイバー攻撃トレンド2017年下半期レポート"

きゅういちひでやま
5 years ago
Views:

1 CHECK POINT RESARCH 2017

2 Global Threat Index Map EMEA 20 APAC ABOUT CHECK POINT RESEARCH 27

3 WannaCry Shadow Brokers NSA EternalBlue EternalRomance SMB IoT Mirai WannaCry 2017 Web ThreatCloud World Cyber Threat Map

4 4 Web 2017 CPU Web Web Web % 1 Web Web Nuclear Angler 2017 Internet Explorer Web Web Web Zerodium 2017 Flash Flash Web 2017

5 2017 HTTP SMTP SMTP 55% 62% SMTP Microsoft Office Microsoft Office 2017 RTF

5 HTTP SMTP SMTP 55% 62% SMTP Microsoft Office Microsoft Office 2017 RTF CVE DDE Dynamic Data Exchange Microsoft Office Adobe.xlam.xlb

6 Wannacry NotPetya BadRabbit 3 IoT IoTroop Huawei Satori NSA Shadow Brokers EternalBlue EternalRomance Microsoft SMB Server Message Block Mirai Mirai Internet of Things IoT DDoS 1 2 IoT IoTroop Satori C&C 2 Mirai IoTroop Mirai Mirai WannaCry NotPetya NSA DoublePulsar EternalBlue

7 7 DDoS Google Play Android Viking Horde Android DDoS 2017 Wirex Google Play Wirex DDoS Web Google Play DDoS MilkyDoor 1 Switcher

8 ThreatCloud Cyber Threat Map

RoughTedRoughTed Web 2017 4 5 6 RoughTed 150 7 28% 18% 3

9 9 EMEA 4 EMEA 5 EMEA APAC 6 APAC 7 APAC CoinHive Monero Web % CoinHive Web CoinHive JavaScript RoughTedRoughTed Web RoughTed % 18% 3 2 RoughTed 1 Necurs APAC Locky Necurs Necurs Scarab

10 10 8 EMEA 9 APAC 10 EMEA 11 APAC Locky Globeimposter Globeimposter Necurs Globe Globeimposter EMEA APAC 2

11 11 12 EMEA 13 APAC 14 EMEA 15 APAC 2017 Trickbot Trickbot Zeus Ramnit WebWeb Trickbot docx SMB

12 12 16 EMEA 17 APAC 18 EMEA 19 APAC Android Hiddad ios Apple App Store ZergHelper APACAndroid Lokibot 5% EMEA

13 13 20 EMEA 21 APAC 22 EMEA 23 APAC 2 Crypto Loot Monero JavaScript CoinHive CoinHive Crypto Loot BitCoin Monero

14 14 24 Global Threat Index Map World Cyber Threat Index Map

15 15 IPS SMB CVE CVE CVE EternalBlue EternalRomance NSA SMB Shadow Brokers WannaCry NotPetya BadRabbit Apache Struts 2 CVE Apache Struts 2 Equifax Apache Struts ,300 IoT CVE IoT IoT 2017 IoT IoTroop IoTroop IoT WIFICAM IP DLINK RTF CVE CVE Microsoft Office RTF PowerShell DDE Microsoft Dynamic Data Exchange DDE Microsoft 2017 DDE Office Office Microsoft DDE Microsoft 12 Word DDE DDE 1990 FIN %

17 Web 2018 Bitfinex BTC 6, Tether Limited USDT 3, Bitcoin13 BTC Reddit ID CryptoShuffler 14 Bitcoin Amazon S3 1 9, TB 2017 Microsoft 1 3 Security and Protection

18 IoT IoT Mirai IoT DDoS Mirai IoT Mirai IoTroops 9 IoT IoT IoT IoT IoT DDoS IoT 2 Web Adwind RAT Adwind Java Windows Mac OS X Linux Android IoT 2017 Android Google OS Android 8.0 Oreo 0.3% Android 2018 Android Android 1

19 Fireball Web Web CPU Shadow Brokers NSA 2017 WannaCry IoTroops NSA Shadow Brokers 2017 Flash Microsoft Office 2016 Conficker Cryptowall Zeus 2017 Locky Jaff RoughTed Necurs Trickbot Trickbot SMB ThreatCloud ThreatCloud 1 2 5,000 1, Web

20 Verizon 1,400 Nice Systems PIN 7 8 HBO 1.5 TB HBO Bitcoin 25 HBO 5 9 FBI 307 5, TheDarkOverlord HBO Netflix 9 10 Equifax 1 4,500 1, , , Equifax CIO CSO Visa Mastercard 20Equifax CEO Apache Struts 11 4,000 VerticalScope , EMEA IBM 8 EirGrid 1

21 APT28 Fancy Bear Wi-Fi APT28 NSA SMB EternalBlue 9 PUP CCleaner Avast Piriform Piriform CCleaner APAC 9 AXA Insurance 5, ,000 IRINN IP 10 Hyatt Corp Hyatt ,500 3, WWPKG Holdings 20 ID

22 Adwind - Adwind Java Runtime Environment URL / / Andromeda - Andromeda 2011 Angler - Angler Angler JavaScript Flash Java Silverlight Acrobat Internet Explorer Badjoke - Badjoke Microsoft Windows BadRabbit - Worm.Win32.BadRabbit Windows SMB / EternalRomance MBR MBR Bancos - Bancos Web Web 2006 Bosuoa - Android SMS Cerber Cerber C&C Cerber 1 Ransomware-as-a-Service Cerber Cloudhopper - APT APT10 IT CoinHive - Web Monero Web JavaScript CoinNebula - Web Web JavaScript

23 2 23 Conficker - Conficker Windows OS OS Facebook Skype Web Crypt - Crypt Cryptoload - Cryptoload Cryptowall TeslaCrypt Locky Fareit Cryptolocker - Cryptolocker 2013 Windows Operation Tovar Gameover Zeus Cryptolocker Cryptolocker Cryptoloot - Web Monero Web JavaScript CryptoShuffler - CryptoShuffler ID 14 BTC Bitcoin Dogecoin Litecoin Dash Ethereum Monero Zcash DLoader - DLoader Microsoft Windows Web Donoff - Donoff Microsoft Word Dorvku - Dorvku Windows Web Dridex - Dridex Windows Dyreza - Dyre Windows Chrome Firefox Internet Explorer 3 Fareit Upatre Upatre Dyre Gameover Zeus Ramnit Shylock Dyre 1 Fireball - Fireball Rafotech

24 2 24 GlobeImposter - GlobeImposter Globe crypt Hiddad - Android OS Hummingbad - rootkit Android IoTroop IoT Mirai Mirai IoTroop IoT IsraBye - IsraBye Jaff Necrus DOCM PDF 1 1 Ldpinch - Ldpinch Windows Locky - Locky Windows Bitcoin Run Lokibot - Android WhatsApp Outlook Skype Lotoor - Lotoor Android root MilkyDoor - MilkyDoor Android Socket Secure SOCKS C&C SSH Nivdort - Nivdort Windows Windows IP DNS Windows NotPetya Petya MBR SMB EternalBlue M.E.Doc Nuclear - Nuclear Exploit Kit cookie IP 1 Nuclear JavaScript Flash Silverlight PDF Internet Explorer

25 2 25 Nymaim - Nymaim 2013 BlackHole Vawtrak Miuref Pony Ursnif Papoto - Web Monero Web JavaScript Pushdo - Pushdo Cutwail Qbot - Qbot Qakbot HTTP Ramnit - Ramnit FTP C&C Web SNS Retrieve - Retrieve DNS Rocks - Web Web JavaScript RoughTed - RoughTed Web Schemouth - Web Monero Web JavaScript Tinba - Tinba BlackHole Web Web Web Tiny Banker Zusy Toga - Toga Windows Triada - Android URL

26 2 26 Trickbot - Trickbot Dyre Trickbot Web C&C Web Man-in-the- Browser MitB Trickbot Viking Horde - Viking Horde Android IP root root Virut - Virut 1 DDoS USB.exe.scr IRC WannaCry Windows SMB EternalBlue WannaCry SMB WannaCry Winnti - Winnti Windows rootkit Windows WireX - Android Clicker Wirex Android Google Play 300 DDoS DDoS 12 Android XcodeGhost - XcodeGhost ios Xcode XcodeGhost C&C ZergHelper - ios Apple 2 Apple Zeus - Zeus Windows C&C Zeus Ztorg - Android Ztorg

27 ABOUT CHECK POINT RESEARCH 27 ABOUT CHECK POINT RESEARCH Check Point Research provides leading cyber threat intelligence to Check Point Software customers and the greater intelligence community. The research team collects and analyzes global cyber attack data stored on ThreatCloud to keep hackers at bay, while ensuring all Check Point products are updated with the latest protections. From the moment a breach is initiated, ThreatCloud begins sharing data across the entire network, providing researchers with the intelligence they need to deeply analyze and report on attacks. Check Point Research publications and intelligence sharing fuel the discovery of new cyber threats and the development of the international threat intelligence community to keep you secure. LEADING THE THREAT INTELLIGENCE COMMUNITY The research team consists of over 100 analysts and researchers currently cooperating with other security vendors, law enforcement, and different CERTs. Their data sources also include open sources, the ThreatCloud customer sharing network, and dark web intelligence. Internally, the team has developed their own machine learning modules, anomaly detection, reverse engineering, and campaign hunting techniques that all assist in staying ahead of hackers and the latest cyber threats.

2018 セキュリティ・レポート

2018 セキュリティ・レポート 2018 3 7 2017 15 34 21 45 40 2018 1 2 2018 2017IT IoT 5 2018 1 2017 Uber Equifax Bluetooth CIA 2017 5 97% 5 2018 2018 3 2017年に発生した主なサイバー攻撃時系列 2017年に発生した主なサイバー攻撃時系列クレジットカード/ デビットカード決済の大手Verifone

チェック・ポイント サイバー攻撃トレンド2017年下半期レポート

チェック・ポイントサイバー攻撃トレンド2017年下半期レポート