What We Do
How we do it
Resources
SECURITY ADVISORIES
Jul 26, 2021
PetitPotam NTLM Relay Attack
THE THREAT PetitPotam is a variant of NTLM Relay attacks discovered by security researcher Gilles Lionel. Proof of Concept code released last week [1] relies on the Encrypting File System Remote (EFSRPC) protocol to provoke a Windows host into performing an NTLM authentication request against an attacker-controlled server, exposing NTLM authentication details or authentication certificates.…
Read More
View all Advisories →
Company
ABOUT eSENTIRE
About Us
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 1000+ organizations in 70+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Read about how we got here
Leadership Work at eSentire
LATEST PRESS RELEASE
Jul 12, 2021
Tecala and eSentire Partner to Protect Enterprises across APAC from Business-Disrupting Cyber Attacks
Sydney, 12 July, 2021 - Tecala, Australia’s award-winning technology services and IT consulting provider, today announced it has chosen eSentire, the global Authority in Managed Detection and Response (MDR) cybersecurity services, as their exclusive MDR solution provider in Australia and New Zealand. This partnership will enable Tecala to augment its cybersecurity practice and offer enterprises…
Read More
Partners
PARTNER PROGRAM
Partners
Our award-winning partner program offers financial rewards, sales and marketing tools and personalized training. Accelerate your business and grow your revenue by offering our world-class Managed Detection and Response (MDR) services.
Learn about our Partner Program
Resources
Blog — Dec 18, 2018

Highlights of eSentire's 2018 Annual Threat Report

2 min read

eSentire’s 2018 Year End Threat Report offers an expansive overview of the threat landscape in 2018. The content and analysis for this report is built off of intelligence gathered from 2,000+ proprietary network and host-based detection sensors. This blog post is presented to highlight some of the most interesting and important findings; to learn more, you can read the full report.

In 2018, the use of botnets increased 500 percent over 2017, with Mirai and its variants continuing to be the most observed threat. This surge in botnet activity led to a 250 percent increase in overall intrusion attempts when compared to 2017. As IoT devices continue to increase in numbers, they continue to be a significant contributor to a rapidly growing threat surface which increases with each newly published exploit.

Throughout 2018, coinmining emerged in two forms: malware on compromised assets and in-browser mining that persists only through the browsing session. Once infected, the coinmining malware silently mines cryptocurrency while consuming a significant amount of CPU cycles resulting in compromised devices with sluggish performance and reduced battery life. Numerous financially-motivated incentives have led threat actors to prefer coinmining over alternative methods such as ransomware, and these incentives drove a fifteenfold year-over-year increase in the amount of coinmining observed by eSentire.

Multiple Maldocs downloaders continued to propagate during 2018. Marap emerged as a new threat, while Emotet’s increased its pervasiveness by adding enhancements. This allowed it to evade detection, spread internally on a network, and deliver modular packages. Maldocs downloaders typically enter organizations embedded within Office and PDF documents delivered through email, however, 2018 also saw the addition of seasonally-themed (Winter holiday, Independence Day) lures disguised as greeting cards.

The Top 10 affected industries in 2018 remained the same as in 2017. For many industries, however, their placement within the Top 10 shifted. Most shifts were small (one or two rankings), but the education industry climbed to first place from 10th place. This change for the education industry is likely a result of the combination of a highly exposed threat surface with an increased volume in botnet activity. DocuSign continues to dominate phishing lures in the corporate environment, followed by Office365 and OneDrive.

With the exponential growth of cybersecurity threats being a common theme in 2018, 2019 will present significant challenges for organizations looking to stay ahead of threats. For even the best-prepared organizations, the increase in threats will present considerable operational and financial challenges as sophisticated tools make it easier and more economical than ever for threat actors to execute attacks. In order to stay ahead, it will be crucial for both organizations and security vendors to turn to emerging technologies such as artificial intelligence (AI) to help take on a proactive approach to protecting their most valuable assets.

eSentire Threat Intel
eSentire Threat Intel Threat Intelligence Research Group