{"id":27170,"date":"2016-12-02T13:15:41","date_gmt":"2016-12-02T05:15:41","guid":{"rendered":"http:\/\/www.upgrademag.com\/web\/?p=27170"},"modified":"2016-12-02T13:15:41","modified_gmt":"2016-12-02T05:15:41","slug":"kaspersky-labs-top-threat-predictions-2017","status":"publish","type":"post","link":"http:\/\/www.upgrademag.com\/web\/2016\/12\/02\/kaspersky-labs-top-threat-predictions-2017\/","title":{"rendered":"Kaspersky Lab’s top threat predictions for 2017"},"content":{"rendered":"

Kaspersky Lab\u2019s discovery in 2016 of an APT able to create new tools for each victim has effectively killed off \u2018Indicators of Compromise\u2019 as a reliable means of detecting infection, according to the company\u2019s Threat Predictions for 2017. \u00a0<\/span><\/strong><\/p>\n

\"Kaspersky<\/span><\/p>\n

The predictions are prepared annually by the company\u2019s expert Global Research and Analysis Team (GReAT) and are based on its wide-ranging insight and expertise.\u00a0 The list for 2017 includes the impact of bespoke and disposable tools, the growing use of misdirection in terms of attacker identity, the fragility of an indiscriminately Internet-connected world, and the use of cyberattacks as a weapon of information warfare.<\/span><\/p>\n

The decline of IoCs<\/strong><\/p>\n

Indicators of Compromise (IoCs) have long been an excellent way of sharing traits of known malware, allowing defenders to recognize an active infection. The discovery by GReAT of the ProjectSauron APT<\/a> changed this. Analysis of the group revealed a bespoke malware platform where every feature was altered for each victim, rendering IoCs unreliable for detecting any other victim, unless accompanied by another measure, such as strong Yara rules.<\/p>\n

The rise of ephemeral infections<\/strong><\/p>\n

In 2017, Kaspersky Lab also expects to see the appearance of memory-resident malware that has no interest in surviving beyond the first reboot that will wipe the infection from the machine memory. Such malware, intended for general reconnaissance and the collection of credentials, is likely to be deployed in highly sensitive environments by stealthy attackers keen to avoid arousing suspicion or discovery.<\/p>\n

\"Kaspersky<\/span><\/p>\n

\u201cThese are dramatic developments, but defenders will not be left helpless. We believe that it is time to push for the wider adoption of good Yara rules.\u00a0 These will allow researchers to scan far-and-wide across an enterprise, inspect and identify traits in binaries at rest, and scan memory for fragments of known attacks. Ephemeral infections highlight the need for proactive and sophisticated heuristics in advanced anti-malware solutions,\u201d said Juan Andr\u00e9s Guerrero-Saade, Senior Security Expert, Global Research and Analysis Team.<\/span><\/p>\n

Other Top Threat Predictions for 2017<\/span><\/h2>\n