Botnets and APTs Are Big BusinessProfessional, online criminal organizations invest heavily in botnets in order to launch APTs and targeted attacks for one simple reason – they make lots and lots of money, with very little risk of discovery or prosecution. These attacks come from very well-funded, highly structured entities that operate much like corporations, with sophisticated development, production, marketing and quality assurance procedures. These organizations invest significant amounts of time and money building logical groupings of compromised systems that are organized around a sophisticated, resilient Command-and-Control (CnC) infrastructure. These criminal networks are exceptionally stealthy and easily evade signature or behavior-based defenses. They can mimic normal application and traffic patterns, and can change their core software far faster than traditional security solutions can update their databases. The criminals behind these attacks are serious about making money off their victims over an extended period of time. The goal, therefore, is not notoriety, but to ensure a stable business model for malicious behavior. Even when lower level or careless individuals are identified and arrested, the broader criminal infrastructure and activity remains. Breaches from these attacks that steal critical information typically generate hidden losses that don't show up until well after the fact. Even worse, every compromised system is under malicious remote control, without IT or security being aware of the penetration. These corporate assets are frequently used to attack other organizations or spread malware, which creates dangerous fiduciary breaches and opens the organization to significant legal, financial and brand liability. Damballa® detects and terminates botnet and crimeware activity. Damballa Failsafe identifies specific compromised systems and associated malware, terminates active threats and delivers critical forensic information in order to prevent these threats from making your organization their next victim. The result is a faster, accurate and more targeted response within and across the enterprise. 
|
