What We Do
How we do it
Resources
TRU INTELLIGENCE CENTER
Our Threat Response Unit (TRU) publishes security advisories, blogs, reports, industry publications and webinars based on its original research and the insights driven through proactive threat hunts.
View Threat Intelligence Resources →
SECURITY ADVISORIES
Jan 19, 2023
Increased Activity in Google Ads Distributing Information Stealers
THE THREAT On January 18th, 2023, eSentire Threat Intelligence identified multiple reports, both externally and internally, containing information on an ongoing increase in Google advertisements…
Read More
View all Advisories →
Company
ABOUT ESENTIRE
About Us
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 1500+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Read about how we got here
Leadership Work at eSentire
LATEST PRESS RELEASE
Dec 13, 2022
eSentire Named First Managed Detection and Response Partner by Global Insurance Provider Coalition
Waterloo, ON – December 13, 2022 – eSentire, Inc., the Authority in Managed Detection and Response (MDR), today announced it has been named the first global MDR partner by Coalition, the world’s first Active Insurance provider designed to prevent digital risk before it strikes. Like Coalition, eSentire is committed to putting their customers’ businesses ahead of disruption by improving their…
Read More
Partners
PARTNER PROGRAM
e3 Ecosystem
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
Learn more
ECOSYSTEM PARTNER RESOURCES
Apply to become an e3 ecosystem partner with eSentire, the Authority in Managed Detection and Response.
Login to the Partner Portal for resources and content for current partners.
Search
Resources
Blog — Dec 01, 2017

Cyber threats: a holiday tradition

2 minutes read
Speak With A Security Expert Now

While shoppers are busy, so are opportunistic threat actors. The holiday season invariably includes great deals, online shopping, the sending and receiving of packages, and waves of emails. To make the season even more hectic, there are cyber criminals attempting to exploit all of these holiday factors.

What we are seeing:

The Security Operations Center (SOC) at eSentire keeps a close eye on security trends and what threat types are prevalent in the wild. In the two weeks leading up to Black Friday this year, there were two major spikes in information gathering events (see figure 1)—these are instances of actors scanning for system vulnerabilities. Following these two spikes, the number of intrusion attempts showed distinct increases. The intrusion attempts category is comprised of illegitimate login attempts and exploiting both known and unknown vulnerabilities.

Due to the temporal occurrence of these events it can be stated with high confidence that the information gathering threats and intrusion attempts are correlated. Once cyber criminals identified vulnerabilities in their scans (Information Gathering), they proceeded to attempt to exploit these vulnerabilities (Intrusion Attempts). This activity occurred in the weeks leading up to Black Friday and Cyber Monday, two extremely popular shopping days.

The Threat Intelligence team at eSentire has also identified multiple malware droppers, such as Emotet and Hancitor, being used to deliver credential stealing banking malware like IcedID, Ursnif and Vawtrack.

(Figure One: The event count from November 13-24 for Information Gathering and Intrusion Attempts)

External Activity:

The worries surrounding security and theft during the holidays can feel overwhelming, but you aren’t alone. On November 27th (Cyber Monday) a joint operation was conducted that seized over 20,500 domains used to sell counterfeit goods. Operation “In Our Sites” was led by Interpol and included law enforcement agencies from 25 European Union member states and the FBI [1]. The removal of unscrupulous sites like these, especially before big shopping days, makes the internet safer for all of us.

Government organizations such as the Internal Revenue Service (IRS) have placed an added focus on phishing this season with awareness reports [2]. There is a general consensus among security professionals that the threat posed by phishing emails is greater during holiday seasons. Seasonal themed phishing emails may include fake sales and notifications of package delivery. With all the ads and emails over this season, it is easy to forget about security, but phishing is one of the main methods criminals use for stealing information and delivering malicious content.

Simple Steps to Keep Yourself Safe

There are some simple steps that should be implemented year-round to help keep users safe from cyber-threats. Use unique passwords for all accounts so that if one account is compromised the malicious actor will not be able to easily compromise your other accounts. A longer password is a stronger password; make use of a passphrase rather than a single word password that could be easily broken by a brute force or dictionary attack. Only visit trusted websites that use secure communication processes; look for the padlock icon to left of the URL to be sure (see figure 2). The padlock indicates that the connection is secure. Lastly, it is always a good idea to regularly check bank and credit card statements to be sure that you haven’t been compromised.

(Figure Two: Secure connection example)

Stay secure and enjoy the incoming holiday season!

External Links

[1] https://www.irs.gov/newsroom/national-tax-security-awareness-week-no-2-dont-take-the-bait-avoid-phishing-emails-by-data-thieves

[2] https://www.europol.europa.eu/newsroom/news/biggest-hit-against-online-piracy-over-20-520-internet-domain-names-seized-for-selling-counterfeits

View Most Recent Blogs
eSentire Threat Intel
eSentire Threat Intel Threat Intelligence Research Group