New Kaspersky Threat Attribution Engine connects new attacks to APT groups in seconds

guest · Jun 9, 2020

New Kaspersky Threat Attribution Engine connects new attacks to APT groups in seconds
Kaspersky has released its new threat intelligence solution
June 9, 2020
https://www.kaspersky.com/about/pre...hreat-attribution-engine-connects-new-attacks

By knowing who is attacking their company, and for what purpose, security teams can quickly come up with the most tailored incident response plan for the attack. However, unveiling the actor who is behind an attack is a challenging task, which requires not only a large amount of collected threat intelligence (TI) but also the right skills to interpret it. To automate the classification and identification of sophisticated malware, Kaspersky presents its new Kaspersky Threat Attribution Engine.

The solution has evolved from an internal tool used by Kaspersky’s Global Research and Analysis Team (GReAT), a world-renowned team of experienced threat hunters.
Click to expand...

Depending on how similar the analyzed file is to the samples in the database, Kaspersky Threat Attribution Engine calculates its reputational score and highlights its possible origin and author with a short description and links to both private and public resources, outlining the previous campaigns. Kaspersky APT Intelligence Reporting subscribers can see a dedicated report on tactics, techniques and procedures used by the identified threat actor, as well as further response steps.
Click to expand...

guest · Jun 12, 2020

Which hacker group is attacking your corporate network? Don’t guess, check!
June 10, 2020
https://www.kaspersky.com/blog/kaspersky-threat-attribution-engine/35852/

About four years ago, cybersecurity became a pawn in geopolitical games of chess. Politicians of all stripes and nationalities wag fingers at and blame each other for hostile cyberespionage operations, while at the same time — seemingly without irony — enlarging their own countries’ offensive cyberweaponstools.

However, whether the hacker group might belong to Military Intelligence Sub-Unit 233, the National Advanced Defense Research Projects Group, or the Joint Strategic Capabilities and Threat Reduction Taskforce (none of which exists, to save you Googling them) … that is a political issue, and there, the likelihood of factual manipulation approaches 100%
Attribution goes from being technical, evidence-based, and accurate to … well, fortune-telling. So, we leave that to the press. We stay well away.
Click to expand...

We keep a close watch on all large hacker groups and their operations (600+ of them), and pay zero attention to what their affiliation might be. A thief is a thief and should be in jail. And now, finally, more than 30 years since I started out in this game [...] we launched an awesome new service for cybersecurity experts. It’s called the Kaspersky Threat Attribution Engine.

It analyzes suspicious files and determines from which hacker group a given cyberattack comes. Knowing the identity of one’s attacker makes fighting it much easier: It enables informed countermeasures. Decisions can be made, a plan of action can be drawn up, priorities can be set out, and on the whole an incident response can be rolled out smoothly and with minimal risk to the business.
Click to expand...

PS: I highly recommend a read of this post by Costin Raiu, one of the parents of this product, in which he goes into detail about the story of how it was developed and also explains some of the finer points of Kaspersky Threat Attribution Engine on the whole.
Click to expand...

Log in or Sign up

New Kaspersky Threat Attribution Engine connects new attacks to APT groups in seconds

guest Guest

guest Guest

Log in or Sign up

New Kaspersky Threat Attribution Engine connects new attacks to APT groups in seconds

guest Guest

guest Guest

Useful Searches