TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

F5 Labs

Regional Threat Perspectives, Fall 2019: Middle East

2019-11-21 · Read original ↗

ATT&CK techniques detected

13 predictions
T1046Network Service Discovery
89%
“france ) and rm engineering ( moldova ) sent much less traffic toward middle eastern systems. top attacking ip addresses the top 4 ip addresses attacking systems in the middle east from august 1, 2019 through october 31, 2019 were all assigned in russia and were engaged in either…”
T1584.005Botnet
82%
“of iot botnets, also known as thingbots. - the top ports targeted in the middle east followed similar patterns as the rest of the world, with smb port 445 as the top attacked port followed by ssh port 22, vnc port 5900, and http port 80. looking past the top 7 attacked services, …”
T1071.001Web Protocols
79%
“at position 6 ). the middle east also received a considerable amount of traffic from ip addresses assigned in romania ( position 11 ) and in ukraine ( position 13 ). the middle east is one of two regions to receive malicious traffic from romania, the other being russia. in regard…”
T1090.003Multi-hop Proxy
76%
“traffic could have gone through a proxy server or compromised system or iot device with ip addresses assigned in a particular country. for expediency, we refer to these as “ top source traffic countries. ” ip addresses assigned to russia launched the most malicious traffic agains…”
T1071.001Web Protocols
60%
“is a calculated number considering the number of attack collection sensors region to region. we use normalized attack data in these reports in order to accurately compare attack data between regions and ensure that no one region is overrepresented in the total data analysis. the …”
T1090.002External Proxy
57%
“traffic could have gone through a proxy server or compromised system or iot device with ip addresses assigned in a particular country. for expediency, we refer to these as “ top source traffic countries. ” ip addresses assigned to russia launched the most malicious traffic agains…”
T1078.001Default Accounts
51%
“activity. additionally, locking down any of the top targeted ports that do not absolutely require unfettered internet access should be completed as soon as possible. and because default vendor credentials are commonly left in place, and the volume of breached credentials in 2017 …”
T1584.005Botnet
47%
“number one source of attacks targeting systems in the middle eastern came from ip addresses assigned to russia, which launched more malicious traffic to the region than ip addresses assigned to the netherlands, in second position. the middle east was the most popular target of at…”
T1210Exploitation of Remote Services
46%
“in france, were launching brute force and credential stuffing attacks against remote frame buffer ( rfb ) / vnc port 5900, globally. all regions of the world are being hit with these same attacks from the following ip addresses : - 185. 153. 197. 251 - 185. 153. 198. 197 - 46. 10…”
T1584.005Botnet
45%
“##rs and are commonly attacked by iot botnets ( thingbots ). we called out these ports in our 2017 report, the hunt for iot : the rise of thingbots. figure 6. top 20 ports attacked in the middle east, august through october 2019 conclusion in general, the best approach a security…”
T1190Exploit Public-Facing Application
36%
“in france, were launching brute force and credential stuffing attacks against remote frame buffer ( rfb ) / vnc port 5900, globally. all regions of the world are being hit with these same attacks from the following ip addresses : - 185. 153. 197. 251 - 185. 153. 198. 197 - 46. 10…”
T1190Exploit Public-Facing Application
31%
“the middle east by a large margin. in a distant second was ssh port 22. both of these ports are commonly targeted as exploiting a vulnerability, and either port can give a malicious actor access to the entire system. the third most attacked port, vnc 5900, was being attacked all …”
T1071.001Web Protocols
30%
“regional threat perspectives, fall 2019 : middle east f5 labs, in conjunction with our partner baffin bay networks, set out to research global attack traffic by geographic region to gain a deeper understanding of the cyberthreat landscape. aside from attack campaigns targeting th…”

Summary

IP addresses assigned in Russia launched significantly more attacks against Middle East systems than any other regions of the world.