Over the past few years, a new development has occurred: predictive software systems are being programmed using artificial intelligence techniques. The latest advances in these kinds of tools use swarm technology to leverage massive databases of expert knowledge comprised of billions of constantly updated bits of data in order to make accurate predictions.
Now the bad news: this technology has not gone unnoticed by cybercriminals. Recent findings from Fortinet threat researchers reveal that intelligent botnets have repeatedly attacked the Apache Struts framework vulnerability responsible for the Equifax hack. Attackers use automation and intelligent decision trees to exploit proven vulnerabilities.
Worse, what bodes ill for the future is that botnets will evolve into hivenets, a type of attack that is able to leverage peer-based self-learning to target vulnerable systems with minimal supervision. Hivenets are intelligent clusters of compromised devices built around swarm technology to create more-effective attack vectors. Whereas traditional botnets wait for commands from the bot herder, hivenets are able to make decisions independently.
Hivenets will be able to use swarms of compromised devices to identify and assault different attack vectors all at once. As it identifies and compromises more devices, a hivenet would be able to grow exponentially, widening its ability to simultaneously attack multiple victims.
Researchers have also discovered that many organizations experience the same botnet infection multiple times, though it is not entirely clear why this is the case; it could be either that the company did not thoroughly understand the scope of the breach and the botnet went dormant, only to return again after business operations went back to normal, or the company never found the root cause. This allows the botnet to return through the same vulnerability.
Organizations using cloud services for online transactions can reduce their risk of exposure to hivenets or botnets by following these basic practices:
This byline originally appeared in Dark Reading
For more information, download our paper and learn about the top threats that enterprise security leaders are being forced to address and the security approaches to evaluate to protect against them.