{"id":53828,"date":"2022-12-07T14:20:18","date_gmt":"2022-12-07T12:20:18","guid":{"rendered":"https:\/\/www.cocus.com\/lockbit-apt-and-siem-protection-against-advanced-attacks-with-cocus\/"},"modified":"2023-11-17T11:17:22","modified_gmt":"2023-11-17T09:17:22","slug":"lockbit-apt-siem-protection-advanced-attacks","status":"publish","type":"post","link":"https:\/\/www.cocus.com\/en\/lockbit-apt-siem-protection-advanced-attacks\/","title":{"rendered":"LockBit, APT and SIEM – Protection against advanced attacks with COCUS"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\tToday, we’ll explain what to look for in cybersecurity and how you can protect yourself and your business with Security Information and Event Management (SIEM) systems.\n

\nLockBit has struck again- this time it has hit automotive supplier Continental: the attackers were able to extract 40 TB of partially sensitive data. There is a threat of full publication of the data by the blackmailers. Continental was apparently lucky in this respect: the attack was detected before the cybercriminals could encrypt or delete the data at Continental. \t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

LockBit is an example of increasingly advanced attacks<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\tLockBit is just one variant of constantly evolving ransomware attacks in a long line of extortion cyberattacks. “Ransomware-as-a-service” models allow cybercriminals to rent complete ransomware attack infrastructures and use them to attack enterprises. LockBit is thus just one example of the increasingly professional attacks being carried out, including by non-governmental organizations. Cybercriminals and so-called “Advanced Persistent Threats (APT)” operate in a highly organized manner and are constantly on the lookout for new ways to break into companies. \n

\n10-15 years ago, viruses and spyware were the biggest cybersecurity concern for enterprises. Antivirus (AV) solutions entered the market to scan suspicious files and check for virus signatures. Over time, additional phishing and malware attacks emerged. Again, using a similar approach to antivirus, email filters can scan for phishing attempts or compromised links to prevent attackers from succeeding. \n

\nAs time passed and the number of attacks increased, the attacks became more targeted. Cybercriminals learned to act more and more professionally as they constantly search for new ways to break into companies. Advanced Persistent Threats (APTs) are advanced attacks by organized groups that penetrate a network in multiple phases, systematically spreading throughout the enterprise while evading detection. Their overarching goal is to steal, manipulate, encrypt, or delete information for commercial or political gain. \t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Protection against advanced attacks through detection<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\tIn order to protect against any kind of attack, it is still essential to take preventive measures in the area of cybersecurity. Security tools such as virus scanners are hygiene factors in the area of cybersecurity. The application of design principles such as security-by-design or zero trust<\/a> also help to defend against attacks. \n

\nHowever, prevention is not enough due to increased complexity and the human factor. Studies such as Mandiant’s M-Trends Report show that advanced attacks are difficult to detect:

\n