Google, Mandiant highlight top threats, evolving adversaries

SAN FRANCISCO -- Adversary groups associated with China and North Korea are becoming increasingly innovative, from choosing specific targets to leveraging zero-day vulnerability exploits, Mandiant and Google executives warned during a panel discussion at RSA Conference 2023.

Sandra Joyce, executive vice president and head of global intelligence at Mandiant, moderated Google's Threat Intelligence media briefing Monday to kick off RSA Conference 2023. Joining her were panelists Kristen Dennesen, reporting analyst at Google's Threat Analysis Group; John Hultquist, vice president of Mandiant intelligence analysis at Google Cloud; and Charles Carmakal, CTO of Mandiant consulting at Google Cloud.

The panel discussion addressed ransomware trends, current geopolitical observations, and the evolution of state-sponsored threat groups. Though most of the threat groups have been a known risk to enterprises for decades, one group stood out for its progression despite its infancy: teenagers in the U.S.

The panelists highlighted adversary group advancements such as North Korea-associated actors being more motivated to go after cryptocurrency, targeting vulnerability researchers and increasing supply chain compromises. Hultquist warned he's seen North Korean threat actors try new techniques now more than ever.

Additionally, he observed vast improvements in Chinese threat actors' infrastructure. One example Hultquist provided was the ability to hide their infrastructure in Soho routers through a network of proxies. Russian threat actors are doing the same, he said.

Carmakal added that Chinese threat actors are becoming specific in the types of targeted organizations. Defense contractors, government entities, telecommunications, and technology companies are particularly preferred.

Even more alarming is an increase in Chinese-nexus actors exploiting zero-day vulnerabilities in edge devices or systems that don't support endpoint detection and response (EDR) tools. He highlighted recent attacks that targeted products such as Sonicwall and Fortinet VPN appliances and VMware hypervisors.

"The initial attack started with zero-day vulnerability exploitation. And what we're finding is these actors are deploying malware on Fortinet firewalls or VMware hypervisors, and it's hard for companies to discover the problem," Carmakal said during the panel. "Even as a customer, even if you have administrative access, you don't have the ability to view processes, view files on the file system, or acquire memory or install security telemetry."

The problem doesn't end with Chinese-nexus groups, the panelists said. There's been a spike in the overall threat landscape of attackers exploiting zero-day vulnerabilities at increasing speed.