"If a domain only stays online for a few days or hours, criminal communications can go undiscovered for long periods of time," the report stated. "Security teams should look for active communications originating from inside the network and block outbound attempts."

Damballa observed fluctuating activity based on the number of IPs in use throughout a specific time period. During vacation times – summer and the holiday season – the ratio of domains to IPs increased, indicating that the crew had fewer resources available to move the infrastructure during those times.

Using the Destover Trojan as an example, the study also explained how advanced attackers conceal their tracks to throw investigators off the trail. Destover deletes files off an infected device, rendering it useless. Attackers can stay undetected inside a network, expand their presence and exfiltrate terabytes of sensitive information. Destover is associated with high-profile breaches, including those that targeted Sony Pictures Entertainment and Saudi Aramco.

While researching a new sample of Destover, Damballa's Threat Discovery Center discovered two utilities closely related to Destover: setMFT and afset. Both evade detection while moving laterally through a network to broaden the attack surface. Adversaries can clean and redirect log files and blend them with legitimate system files, and as a result, many of the tools and methods security teams use to identify the presence of attackers fail to detect setMFT and afset. Damballa warned that chances are security personnel will miss them altogether unless they have a continuous monitoring solution that looks for threat-related behavior over time.

"It's no small feat to keep up with how cybercriminals operate," Stephen Newman, chief technology officer for Damballa, said. "Attackers have an incredibly vibrant underground community where they can buy or rent anything from command and control infrastructure to sophisticated exploit kits to bare metal malware. While this report highlights several themes that our Threat Discovery Center has followed over the past several months, there is one common factor here and that is you never know what to expect from threat actors. By shedding light on common techniques, our hope is that enterprises can reassess and improve their existing security controls."