2014 Fall Threat Landscape Report now available

Summary

This 2014 post summarises Palo Alto Networks' Unit 42 Fall Threat Landscape review, a malware-trend report covering delivery channels, application diversity and one dominant malware family observed across thousands of organisations. It targets security-conscious IT and business readers who want a condensed view of the vendor report's key findings. Reported highlights include email and web as the two dominant malware delivery channels, malware appearing in over 50 distinct applications, and the Kulouz/Asprox family responsible for roughly 80% of attack sessions recorded in October 2014. Published in 2014. Figures, product names and event details reflect that time; for current information see the linked service pages.

Key facts

Article

Unit 42, the research division of Palo Alto Networks, have released their 2014 Fall Threat Landscape review. The report is a comprehensive assessment of malware trends affecting thousands of organizations in major industries around the world. Key highlights include:

• All vertical markets saw e-mail (SMTP) and HTTP as the primary channels for malware delivery, but the percentages for each industry vary significantly, indicating that these industries have different threat profiles. Retail and wholesale organizations received almost 28 percent over the web channel, while hospitality organizations received just two percent over the same channel. Organisations need visibility into the types of traffic traversing their networks so they can quickly identify and prevent threats.
• Malware was delivered in over 50 distinct applications, 87 percent of which were delivered over e-mail and 11.8 percent through web browsing (HTTP). While these two channels account for the majority of malware attacks, it is important that organizations are able to identify malware in any application allowed in their network.
• Over 90 percent of unique malware samples were delivered in just one or two attacks. Most of these files are part of overarching malware families, but by deploying distinct files just once or twice attackers can evade many antivirus programs. Practitioners need to consider security that can identify and stop attacks at multiple stages in the attack kill chain.
• One malware family, known as Kulouz or Asprox, was responsible for about 80 percent of all attack sessions recorded during October 2014, impacting nearly 2,000 different organizations. This malware has plagued Internet users for years, despite multiple attempts to disrupt its infrastructure.

blueAPACHE and Palo Alto have partnered to deliver security solutions (including WildFire) on-premise and on the emPOWER Network. To learn more: Download the report from the Palo Alto site.
Contact the blueAPACHE Account team to discuss your security requirements.

Related

• empower core netork dc interconnect
• connectivity
• managed detection response
• empower security top level
• emPOWER Security (pillar hub)

Frequently asked questions

What was the main finding of the 2014 Fall Threat Landscape report?Per the post, malware was overwhelmingly delivered through email (SMTP) and web (HTTP) channels, though the split between the two varied significantly by industry, and one malware family, Kulouz/Asprox, accounted for around 80% of attack sessions recorded in October 2014.

Who published the report the post is summarising?Unit 42, the threat research division of Palo Alto Networks, published the original Fall Threat Landscape review that this post condenses.

Why did malware delivery channels vary so much by industry?The post notes retail and wholesale organisations received almost 28% of malware over the web channel while hospitality organisations received just 2% over the same channel, indicating different industries have materially different threat profiles.

What was blueAPACHE's security partnership referenced in the post?The post states blueAPACHE and Palo Alto Networks had partnered to deliver security solutions, including WildFire, both on-premise and on the emPOWER Network.

Is this specific threat data still relevant today?No. The named malware family and percentages describe the threat landscape of October 2014 specifically. For blueAPACHE's current security capabilities see emPOWER Security and Managed Detection & Response, linked below.

Source

• origin post (2014)

Knowledge Base