What We Do
How we do it
Oct 18, 2021
Grief Ransomware Gang Claims 41 New Victims, Targeting Manufacturers; Municipalities; & Service Companies in U.K. & Europe
Grief Operators Earned an Estimated 8.5 Million British Pounds in Four Months Key Findings: The Grief Ransomware Gang (a rebrand of the DoppelPaymer Ransomware Group) claims to have infected 41 new victims between May 27, 2021—Oct. 1, 2021 with their ransomware.Over half the companies listed on Grief’s underground leak site are based in the U.K. and Europe. The Grief Ransomware Gang appears to…
Read More
View all Advisories →
About Us
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 1000+ organizations in 70+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Read about how we got here
Leadership Work at eSentire
Oct 12, 2021
eSentire Launches MDR with Microsoft Azure Sentinel Extending Response Capabilities Across Entire Microsoft Security Ecosystem
Waterloo, ON – Oct. 12, 2021 -- eSentire, recognized globally as the Authority in Managed Detection and Response (MDR), today announced the expansion of its award-winning MDR services with Microsoft Azure Sentinel, as part of its integration with the complete Microsoft 365 Defender and Azure Defender product suites supporting Microsoft SIEM, endpoint, identity, email and cloud security services.…
Read More
Our award-winning partner program offers financial rewards, sales and marketing tools and personalized training. Accelerate your business and grow your revenue by offering our world-class Managed Detection and Response (MDR) services.
Learn about our Partner Program
Apply today to partner with the Authority in Managed Detection and Response.
Login to the Partner Portal for resources and content for current partners.
Blog — Dec 18, 2018

Highlights of eSentire's 2018 Annual Threat Report

eSentire’s 2018 Year End Threat Report offers an expansive overview of the threat landscape in 2018. The content and analysis for this report is built off of intelligence gathered from 2,000+ proprietary network and host-based detection sensors. This blog post is presented to highlight some of the most interesting and important findings; to learn more, you can read the full report.

In 2018, the use of botnets increased 500 percent over 2017, with Mirai and its variants continuing to be the most observed threat. This surge in botnet activity led to a 250 percent increase in overall intrusion attempts when compared to 2017. As IoT devices continue to increase in numbers, they continue to be a significant contributor to a rapidly growing threat surface which increases with each newly published exploit.

Throughout 2018, coinmining emerged in two forms: malware on compromised assets and in-browser mining that persists only through the browsing session. Once infected, the coinmining malware silently mines cryptocurrency while consuming a significant amount of CPU cycles resulting in compromised devices with sluggish performance and reduced battery life. Numerous financially-motivated incentives have led threat actors to prefer coinmining over alternative methods such as ransomware, and these incentives drove a fifteenfold year-over-year increase in the amount of coinmining observed by eSentire.

Multiple Maldocs downloaders continued to propagate during 2018. Marap emerged as a new threat, while Emotet’s increased its pervasiveness by adding enhancements. This allowed it to evade detection, spread internally on a network, and deliver modular packages. Maldocs downloaders typically enter organizations embedded within Office and PDF documents delivered through email, however, 2018 also saw the addition of seasonally-themed (Winter holiday, Independence Day) lures disguised as greeting cards.

The Top 10 affected industries in 2018 remained the same as in 2017. For many industries, however, their placement within the Top 10 shifted. Most shifts were small (one or two rankings), but the education industry climbed to first place from 10th place. This change for the education industry is likely a result of the combination of a highly exposed threat surface with an increased volume in botnet activity. DocuSign continues to dominate phishing lures in the corporate environment, followed by Office365 and OneDrive.

With the exponential growth of cybersecurity threats being a common theme in 2018, 2019 will present significant challenges for organizations looking to stay ahead of threats. For even the best-prepared organizations, the increase in threats will present considerable operational and financial challenges as sophisticated tools make it easier and more economical than ever for threat actors to execute attacks. In order to stay ahead, it will be crucial for both organizations and security vendors to turn to emerging technologies such as artificial intelligence (AI) to help take on a proactive approach to protecting their most valuable assets.

eSentire Threat Intel
eSentire Threat Intel Threat Intelligence Research Group