question: When security/researchers say they see a large scale hack "in real time" what exactly are they seeing?
comment: Traffic. Those that know what to look for in the traffic are able to determine what communication is actually happening. One simple possibility is that you could be suddenly seeing large amounts of traffic outbound and find that data is being exfiltrated to an unknown destination. You may see in the traffic that a machine connected to a website and suddenly signatures are being tripped due to command and control traffic, for example, where an unknown machine is attempting to control yours.
passages: In 2011, Andress and Winterfeld drew the attention to the fact that while cyber security experts can deliver extensive reports on Internet risks, most of the alerts are still general, unspecific and do not actually meet the expectations of the specific organization. In addition, cyber security companies locate hackers or cyber attackers only when the attack is already in progress or worse - after a given system has already been damaged or compromised.
   Section::::Major threats detected by Group-IB.:Anunak/Carbanak.
  
  In late 2014 Fox-IT and Group-IB jointly released a report on the Anunak (aka Carbanak) hacker group that had stolen more than 1 billion rubles from over 50 Russian banks. In Europe Anunak attacked POS terminals of large retail store chains with data of several million clients infected. The group has not performed successful thefts since early 2015.
  
  Section::::Major threats detected by Group-IB.:Reverse ATM Attack.
   On 29 May 2014, Texas-based cyber espionage research firm "iSIGHT Partners" released a report, uncovering an operation it labels "Newscaster" since at-least 2011, has targeted at least 2,000 people in United States, Israel, Britain, Saudi Arabia, Syria, Iraq and Afghanistan.
  
  The victims who are not identified in the document due to security reasons, are senior U.S. military and diplomatic personnel, congresspeople, journalists, lobbyists, think tankers and defense contractors, including a four-star admiral.
  
  The firm couldn’t determine what data the hackers may have stolen.
   Operation Shady RAT
  
  Operation Shady RAT is an ongoing series of cyber attacks starting in mid-2006 reported by Dmitri Alperovitch, Vice President of Threat Research at Internet security company McAfee in August 2011, who also led and named the Night Dragon Operation and Operation Aurora cyberespionage intrusion investigations. The attacks have hit at least 71 organizations, including defense contractors, businesses worldwide, the United Nations, and the International Olympic Committee.
   BULLET::::- March: The city of Atlanta, Georgia USA computer systems are seized by hackers with ransomware. They did not pay the ransom, and two Iranians were indicted by the FBI on cyber crime charges for the breach.
  
  BULLET::::- May: A speculative execution exploit named Speculative Store Bypass (sometimes referred to as "Variant 4") is disclosed by researchers. The town of Wasaga Beach in Ontariao, Canada computer systems are seized by hackers with ransomware.
  
  BULLET::::- June: Lazy FP State Restore, a speculative execution exploit affecting Intel Core CPUs, is announced by Intel.
   This feature conducts digital forensic examinations and malware artifact analysis (reverse engineering) to determine attack vectors and mitigation techniques, identifies possible threats based on analysis of malicious code and digital media, and provides indicators to mitigate and prevent future intrusions.
  
  Section::::Capabilities.:Operations.
  
  This feature informs the CND community on potential threats which allows for the hardening of cyber defenses, as well as, develops near real-time/rapid response community products (e.g., reports, white papers).
   BULLET::::1. Indicator of compromise - An indicator of compromise (IOC) tells you that an action has happened and you are in a reactive mode. This type of IOC is could by looking inward at your own data from transaction logs and or SIEM data. Examples of IOC include unusual network traffic, unusual privileged user account activity, login anomalies, increases in database read volumes, suspicious registry or system file changes, unusual DNS requests and Web traffic showing non-human behavior. These types of unusual activities allow security administration teams to spot malicious actors earlier in the cyberattack process.
   Section::::Major threats detected by Group-IB.:Corkow.
  
  In February 2016, Group-IB published a report titled "Analysis of attacks against trading and bank card systems" about the first major successful attack on a trading system provoking major exchange volatility. In February 2015, the Corkow criminal group infected a trading system terminal of Kazan-based Energobank using a specialized Trojan software resulting in trades of more than $400 million. The hackers moved the ruble-dollar rate more than 15 percent in minutes on the Moscow Exchange. The bank claimed losses of 244 million rubles ($3.2 million) due to the trades.
  
  Section::::Major threats detected by Group-IB.:Buhtrap.
   Section::::Computer components.
  
  Section::::Computer components.:Network Interface Card.
  
  Section::::Computer components.:Network Interface Card.:Timing attack.
  
  Timing attacks enable an attacker to extract secrets maintained in a security system by observing the time it takes the system to respond to various queries.
   This feature is involved with reviewing, researching, vetting and documenting all Computer Network Defense (CND) attributes which are available to US-CERT, both classified and unclassified.
  
  It helps promote improved mitigation resources of federal departments and agencies across the Einstein network by requesting deployment of countermeasures in response to credible cyber threats.
  
  This feature conducts technical analysis on data provided from partners, constituents, and monitoring systems to understand the nature of attacks, threats, and vulnerabilities, as well as develop tips, indicators, warnings, and actionable information to further US-CERT’s CND mission.
  
  Section::::Capabilities.:Digital analytics.
   The Army Cyber Institute at West Point in conjunction with Arizona State University's Global Securities Initiative and the School for the Future of Innovation in Society have established a Threatcasting Lab to host and manage a Cyber Threatcasting Project which looks to envision future cyber threats ten years in the future. The first session of this collaborative group was held at West Point, NY in August 2016.
  
  Section::::See also.
  
  BULLET::::- Accelerating Change
  
  BULLET::::- Backcasting
  
  BULLET::::- Creative science foundation
  
  BULLET::::- Environmental Scanning
  
  BULLET::::- Forecasting
  
  BULLET::::- Foresight
  
  BULLET::::- Futures Studies
  
  BULLET::::- Futures Techniques
  
  BULLET::::- Outline of future studies
  
  BULLET::::- Science fiction prototyping
   Today, an important role is played by a Computer Security Incident Response Team (CSIRT), due to the rise of internet crime, and is a common example of incident faced by companies in developed nations all across the world. For example, if an organization discovers that an intruder has gained unauthorized access to a computer system, the CSIRT would analyze the situation, determine the breadth of the compromise, and take corrective action. Computer forensics is one task included in this process. Currently, over half of the world’s hacking attempts on Trans National Corporations (TNCs) take place in North America (57%). 23% of attempts take place in Europe. Having a well-rounded Computer Security Incident Response team is integral to providing a secure environment for any organization, and is becoming a critical part of the overall design of many modern networking teams.
   A common example might be following unauthorized network intrusion. A specialist forensic examination into the nature and extent of the attack is performed as a damage limitation exercise. Both to establish the extent of any intrusion and in an attempt to identify the attacker. Such attacks were commonly conducted over phone lines during the 1980s, but in the modern era are usually propagated over the Internet.
   BULLET::::- ESG Solution Showcase - Cavirin Hybrid Cloud Security
  
  BULLET::::- Joint FBI and DHS report on the DNC hack
  
  BULLET::::- Waterbug Group
  
  BULLET::::- Seedworm
  
  Section::::CTI and political risk.
  
  Influential geopolitical countries, such as the US, Russia, China and Iran, use cyberspace as an extension of their foreign and intelligence collection policies. To achieve these objectives, they have formed APT units that primarily specialise in the following fields:
  
  BULLET::::- Collection of sensitive data from business or government computer systems
  
  BULLET::::- Electronic penetration or sabotage of critical infrastructure computer systems (for example, read about Stuxnet)
   BULLET::::- May 19: The seven members of the hacker think tank known as L0pht testify in front of the US congressional Government Affairs committee on "Weak Computer Security in Government".
  
  BULLET::::- June: Information Security publishes its first annual Industry Survey, finding that nearly three-quarters of organizations suffered a security incident in the previous year.
   Two groups of researchers discovered the security vulnerabilities independently: a Belgian team (including Jo Van Bulck, Frank Piessens, Raoul Strackx) from imec-DistriNet, KU Leuven reported it to Intel on 3 January 2018; a second team from Technion – Israel Institute of Technology (Marina Minkin, Mark Silberstein), University of Adelaide (Yuval Yarom), and University of Michigan (Ofir Weisse, Daniel Genkin, Baris Kasikci, Thomas F. Wenisch) reported it on 23 January 2018. The vulnerabilities were first disclosed to the public on 14 August 2018.
  
  Section::::Mechanism.
   French investigators later discounted the theory that the attack was connected to ISIL, instead suspecting the APT28 or "Pawn Storm", a hacking group with alleged links to the Russian government. Investigators concluded that the attack was a test of the same sorts of cyber-weaponry that were used to switch off a power station in Ukraine.
  
  As a result, Airbus Defence and Space implemented the Keelback Net cyber sensor.
  
  Section::::Content.
   Section::::Major threats detected by Group-IB.:ISIS hacker attacks on Russian resources.
   Also during the Gulf War, Dutch hackers allegedly stole information about U.S. troop movements from U.S. Defense Department computers and tried to sell it to the Iraqis, who thought it was a hoax and turned it down. In January 1999, U.S. Air Intelligence computers were hit by a co-ordinated attack (Moonlight Maze), part of which came from a Russian mainframe. This could not be confirmed as a Russian cyber attack due to non-attribution – the principle that online identity may not serve as proof of real world identity.
  
  Section::::New battlefield.
   BULLET::::- June 21: A spear phishing incident at the Office of the Secretary of Defense steals sensitive U.S. defense information, leading to significant changes in identity and message-source verification at OSD.
  
  BULLET::::- August 11: United Nations website hacked by Turkish Hacker Kerem125.
   BULLET::::- Computer hacker sl1nk releases information of his penetration in the servers of the Department of Defense (DoD), Pentagon, NASA, NSA, US Military, Department of the Navy, Space and Naval Warfare System Command and other UK/US government websites.
  
  BULLET::::- September: Bangladeshi hacker TiGER-M@TE made a world record in defacement history by hacking 700,000 websites in a single shot.
  
  BULLET::::- October 16: The YouTube channel of "Sesame Street" was hacked, streaming pornographic content for about 22 minutes.
  
  BULLET::::- November 1: The main phone and Internet networks of the Palestinian territories sustained a hacker attack from multiple locations worldwide.
   In June 2019, Russia has conceded that it is "possible" its electrical grid was under cyberattack by the United States. The "New York Times" reported that hackers from the U.S. Cyber Command planted malware potentially capable of disrupting the Russian electrical grid.
  
  Section::::Leadership.
  
  The Deputy Commander currently vacant.
  
  Section::::See also.
  
  BULLET::::- United States Strategic Command
  
  BULLET::::- Joint Task Force-Global Network Operations
  
  BULLET::::- United States National Security Agency (NSA)
  
  BULLET::::- United States Department of Homeland Security
  
  BULLET::::- Information assurance vulnerability alert
  
  BULLET::::- Cooperative Cyber Defence Centre of Excellence (NATO)
  
  BULLET::::- National Cyberdefence Centre (Germany)
  
  BULLET::::- Cyberwarfare
   BULLET::::- Post-Evaluation: to assess the success of the planning and implementation, and to identify unresolved areas of concern.
  
  Section::::Systems at risk.
  
  The growth in the number of computer systems, and the increasing reliance upon them of individuals, businesses, industries and governments means that there are an increasing number of systems at risk.
  
  Section::::Systems at risk.:Financial systems.
   BULLET::::- Computer security researchers at Graz University of Technology and Catholic University of Leuven, in a coordinated disclosure with Intel, announce the discovery of a group of Microarchitectural Data Sampling vulnerabilities, affecting millions of Intel microprocessors, which they named Fallout, RIDL (Rogue In-Flight Data Load) and ZombieLoad.
   In January 2015, CENTCOM's Twitter feed was reported to have been hacked on 11 January by ISIS sympathizers. This situation lasted for less than one hour; no classified information was posted and "none of the information posted came from CENTCOM's server or social media sites"; however, some of the slides came from the federally funded Lincoln Laboratory at the Massachusetts Institute of Technology.
  