{"id":17938,"date":"2018-11-02T16:36:59","date_gmt":"2018-11-02T16:36:59","guid":{"rendered":"http:\/\/2cc64353-2b8f-49dc-bf69-abff775ac938"},"modified":"2018-11-02T16:36:59","modified_gmt":"2018-11-02T16:36:59","slug":"hackers-are-increasingly-destroying-logs-to-hide-attacks","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/hackers-are-increasingly-destroying-logs-to-hide-attacks\/","title":{"rendered":"Hackers are increasingly destroying logs to hide attacks"},"content":{"rendered":"
<\/div>\n

Hacker groups are increasingly turning to log file destruction and other destructive methods as a means to hide their tracks, according to a report released this week and containing information from 113 investigations performed by 37 Carbon Black incident response (IR) affiliate partners from across the globe.<\/p>\n

\n

More security news<\/span><\/h3>\n<\/div>\n

According to the report, “politically motivated cyberattacks from nation-state actors have contributed to an ominous increase in destructive attacks: attacks that are tailored to specific targets, cause system outages and destroy data in ways designed to paralyze an organization’s operations.”<\/p>\n

Carbon Black said that hacker groups are getting better at what the company calls “counter-incident response.”<\/p>\n

They said that hackers attempted counter-incident response in 51 percent of all incidents the company and its partners investigated in the last 90 days.<\/p>\n

“We’ve seen a lot of destruction of log data, very meticulous clean-up of antivirus logs, security logs, and denying IR teams the access to data they need to investigate,” an IR professional said.<\/p>\n

In fact, according to the Carbon Black report, 72 percent of all its partner IR professionals saw counter-IR operations in the form of destruction of logs, which appears to have become a standard tactic in the arsenal of most hackers.<\/p>\n

But in some cases, hackers took log destruction and other counter-incident response operations to a new level, and in some cases, their actions resulting in more lasting damage.<\/p>\n

\n<\/section>\n

“Our respondents said victims experienced such attacks 32% of the time,” Carbon Black said in its report<\/a>.<\/p>\n

“We’ve seen a lot of destructive actions from Iran and North Korea lately, where they’ve effectively wiped machines they suspect of being forensically analyzed,” an IR professional said.<\/p>\n

“Attackers want to cover their tracks because they’re feeling the pressure from law enforcement,” another IR professional said.<\/p>\n

But Carbon Black also points out that the cyber-security industry, as a whole, has also gotten much better at incident response, hence attackers’ increased focus on removing logs and even wiping systems, just to be on the safe side.<\/p>\n

Other key findings:<\/h2>\n

The same Carbon Black report also touches on many other interesting topics, such as the use of legitimate tools for lateral movements inside compromised networks, the concept of “island hoping,” and the increased focus on IoT devices as entry points into homes and companies. The summarized key findings are available below:<\/p>\n