AV-Test.org - New Lines of Defense: EPPs and EDRs Put to the Test Against APT and Ran

[harlan4096]

New Lines of Defense: EPPs and EDRs Put to the Test Against APT and Ransomware Attacks

Security leaks, like the recently discovered Microsoft Exchange vulnerability, underscore the dangers facing companies, government agencies and critical infrastructure worldwide. It took only a few days following the news of the massive hack by Hafnium with DearCry for the first ransomware to be unleashed, exploiting the Exchange vulnerability. Following the completion of comprehensive tests, AV-TEST has now released the initial test report of EPP and EDR products, placing a special focus on their detection and threat prevention against APT attacks where ransomware is deployed. In the labs of the IT security institute, 6 endpoint protection platform and 3 endpoint detection & response solutions were put under the microscope.

APT & Ransomware – tactical sabotage attacks are rapidly increasing

Complex technical and targeted strategic cyberattacks are no longer a celestial event, but have rather become part of the everyday life of companies and public agencies. So the question is not if an APT attack will occur, but when. Accordingly, cyberattacks on companies, public agencies, and critical infrastructure, with Hafnium exploiting security leaks and the use of ransomware such as DearCry, already reached a dramatic high point last year. The lion's share of APT attacks identified and analyzed were aimed at espionage, targeting both confidential as well as financially exploitable information. At the same time, there was a rise in the number of APT attacks seeking to block IT infrastructure and to blackmail its owners, to damage or even to destroy data for tactical reasons. In the last quarter of 2020 alone, both government IT structures as well as the networks of important and system-relevant companies increasingly came into the crosshairs of digital acts of sabotage. 

Thus, in November the renowned Center for Strategic and International Studies (CSIS) detected an attack on the electronics conglomerate Foxconn. In the course of a sophisticated ransomware attack, the hackers encrypted 1,200 servers, deleted 30 TB of backups, and took credit for making off with 100 GB of confidential corporate data. In September 2020, the US healthcare provider Universal Health Services, the French shipping company CMA CGM, the largest Pakistani energy utility, along with several government organizations in the Middle East, became the victims of targeted APT attacks deploying ransomware.
...

Full Report