Connect with us

Market Research

Proofpoint’s Annual Human Factor Report Reveals How 2021 Became the Year Cyber Criminals Got Creative

Published

on

Proofpoint, has unveiled its annual Human Factor report, which provides a comprehensive examination of the three main facets of user risk—vulnerability, attacks, and privilege—and how threat actors continue their ceaseless creativity as they exploit the many opportunities presented by people. The Human Factor 2022 report dives deep into user risk, drawing on data and insight from a year’s worth of research, covering threats detected, mitigated, and resolved across one of the largest datasets in cybersecurity.

“One constant that remains as organizations approach a sense of normalcy after a disruptive year is that cyber criminals continue to target and exploit people,” said Ryan Kalember, EVP of cybersecurity strategy, Proofpoint. “Last year attackers demonstrated just how unscrupulous they really are, making protecting people from cyber threats an ongoing—and often eye-opening—challenge for organizations.”

The report draws from a multitrillion-datapoint graph, one of the largest data sets in cybersecurity. Every day, Proofpoint analyzes more than 2.6 billion email messages, 49 billion URLs, 1.9 billion attachments, 28.2 million cloud accounts, 1.7 billion mobile messages, and more. This report analyzes data collected throughout 2021 and sheds light on the nature of today’s cyber threats, while offering actionable insight on how to protect employees against them.

Key findings highlighted in Proofpoint’s 2022 Human Factor report include:

  • Cyber criminals recognize that our smartphone contains the keys to both our personal and professional lives. Smishing attempts more than doubled in the US over the year, while in the UK over 50% of lures were themed around delivery notification. In addition, cyber criminals initiated more than 100,000 telephone-oriented attacks a day.
  • High-privilege users are disproportionately targeted. Managers and executives make up only 10% of overall users within organizations, but almost 50% of the most severe attack risk.
  • Over 80% of businesses are attacked by a compromised supplier account each month. Security awareness training focusing on supply chain threats is business critical for organizations.
  • Microsoft OneDrive and Google Drive are the most common legitimate cloud infrastructure platforms used by threat actors. Last year, 35% of cloud tenants that received a suspicious log-in also experienced suspicious file activity after the breach, revealing that privilege-based risk widens as enterprises move to the cloud. On average, approximately 10% of organizations were found to have at least one authorized active malicious application in their environment.
  • The hand-in-glove relationship between malware groups and ransomware operators continue. More than 20 million messages attempted to deliver malware linked to an eventual ransomware attack between January 1 to December 31, 2021.
  • Attackers piggyback on pop culture. Threat actors used popular figures such as Justin Bieber and The Weeknd, and Netflix series Squid Game in their lures in 2021. By October, cyber criminals were sending Squid Game-themed emails to victims, promising early access to the next season, or even the opportunity to be cast in future episodes.
  • Cyber criminals continue to capitalize on global conflicts. Earlier this year, threat actors and APT groups aligned with national interests responded to Russia’s invasion of Ukraine. We saw destructive wiper malware deployed against Ukrainian organizations and key communications infrastructure, in addition to activity from Belarus– and China-aligned actors, specifically targeting European governmental organizations involved in asylum and other relief efforts.

Emile Abou Saleh, Regional Director, Middle East & Africa at Proofpoint, added: “According to our recent Voice of the CISO Report, almost half of all surveyed UAE CISOs feel their organization is at risk of suffering a material cyber-attack in the next 12 months. To mitigate such risks, organizations will have to be highly vigilant of cyber threats targeting today’s distributed, hybrid workforce. To fully defend organisations, CISOs need to address threat protection, data security and invest in technologies, in-house expertise, user training and awareness programs that put employees at the core of their strategy.”

To download Proofpoint’s Human Factor 2022 report, please visit: https://www.proofpoint.com/us/resources/threat-reports/human-factor.

Cyber Security

Phishing and Scam Hit the Roof in UAE with 230% Increase in Q2 2022: Kaspersky

Published

on

Kaspersky analysis has revealed that attacks related to data loss threats (phishing and scam/social engineering) increased significantly in Q2 2022 at 230% in comparison with the previous quarter in the UAE – the company’s security solutions have detected 3,481,419 phishing attacks in the UAE in Q2.

Social engineering which is sometimes called “human hacking” scams is used in many ways, and for different purposes, to lure unwary users to the site and trick them into entering personal information. The latter often includes financial credentials such as bank account passwords or payment card details, or login details for social media accounts. In the wrong hands, this opens doors to various malicious operations, such as money being stolen or corporate networks being compromised.

Phishing is a strong attack method because it is done on a large scale. By sending massive waves of emails under the name of legitimate institutions or promoting fake pages, malicious users increase their chances of success in their hunt for innocent people’s credentials. Phishers deploy a variety of tricks to bypass e-mail blocking and lure as many users as possible to their fraudulent sites. A common technique is HTML attachments with partially or fully obfuscated code. HTML files allow attackers to use scripts and obfuscate malicious content to make it harder to detect and send phishing pages as attachments instead of links.

According to Kaspersky data, most of Middle East countries saw a staggering increase in attacks related to data loss threats by 159% in the second quarter of 2022 with 15,012,880 phishing scam detections. The highest targeted country was Saudi Arabia with 5,808,946 phishing attacks (a growth by 168%). In particular, while vacation season is high, scammers are trying to lure travellers who are looking for interesting places to go, cheap places to stay and reasonably priced flights. Kaspersky researchers have observed intensified scamming activities, with numerous phishing pages distributed under the guise of airline and booking services. The number of attempts to open phishing pages related to booking and airline services in the first half of 2022 was 4,311 in the META region.

“Planning a vacation is not easy. People can spend weeks, even months, looking for the perfect place to stay and the tickets to get them there. Fraudsters use this to lure users that have grown tired of searching for great deals. After two years of flight restrictions imposed by the pandemic, travelling is back. But so are travel scams – with intensified scamming activity targeting users through fake booking and rental services. Such attacks are totally preventable, which is why we urge users to be sceptical about overly generous offers. If an offer seems too good to be true, it probably is,” comments Mikhail Sytnik, a security expert at Kaspersky.

To keep yourself protected, Kaspersky experts recommend:

  • Carefully look at the address bar before entering any sensitive information, such as your login details and password. If something is wrong with the URL (i.e. spelling, it doesn’t look like the original or it uses some special symbols instead of letters) don’t enter anything on the site. If in doubt, check the certificate of the site by clicking on the lock icon to the left of the URL.
  • Not clicking on links that come from unknown sources (either through e-mails, messaging apps or social networks).
  • Visit the business’ official website if you see a giveaway offered in e-mail or on social media by a travel company or an airline to confirm the giveaway exists. You should also carefully check the links the giveaway ad leads you to.
  • Using a good security solution that can protect you from spam emails and phishing attacks.
Continue Reading

Cyber Security

Cyber Attacks Have Increased Globally by 42% with Ransomware as the Number One Threat

Published

on

Check Point Research (CPR), the Threat Intelligence arm of Check Point Software Technologies Ltd., has released its ‘Cyber Attack Trends: 2022 Mid-Year Report’. The report highlights how cyberattacks have become firmly entrenched as a state-level weapon, including the new ransomware method of ‘Country Extortion’ and state-affiliated hacktivism, and the expansion of ransomware as the number one threat.

Besides insight into the evolution of cyberattacks as a state-level weapon complementing actual military conflict and the elevation of ransomware utilized in nation-state level attacks for financial and social gain, the report also delves into the growth of cloud supply chain attacks through new sources of modules in the open-source community. Up-to-date statistics on the industry and regional cyberattacks as well as advice and predictions for the remainder of 2022 including an analysis of Incident Response exploring the full lifecycle of a cyberattack, presents an integrated view of how cyberattacks have led to major disruption, causing real harm to civic and cyber life in 2022.

“The war in Ukraine has dominated the headlines in the first half of 2022 and we can only hope that it will be brought to a peaceful conclusion soon,” said Maya Horowitz, VP of Research at Check Point Software. “Its impact on cyberspace has been dramatic in both scope and scale, and we have seen huge increases in cyberattacks against organizations in all sectors and all countries this year. Unfortunately, this will only get worse, especially with ransomware now being the number one threat to organizations. However, with the right expertise, strategy and cybersecurity solutions in place, companies are able to prevent attacks from happening.”

Top predictions for H2 highlighted in the report include:

  • Ransomware will become a much more fragmented ecosystem– while ransomware groups have become more structured and operate like regular businesses, with set targets to hit, there will be a lesson learned from the Conti ransomware group, whose size and power garnered too much attention, which led to its downfall. Going forward, we think there will be many small-medium groups instead of a few large ones, to hide in plain sight more effectively.
  • More diverse email infection chains – due to the implementation of internet macros being blocked by default in Microsoft office, the more sophisticated malware families will accelerate the development of new infection chains, with different file types that are password protected to prevent detection as sophisticated social engineering attacks increase.
  • Hacktivism will continue to evolve– hacktivist groups will continue to align their attacks with the agenda of their chosen nation-state, particularly as the Russia-Ukraine war is still ongoing.
  • Continued attacks on decentralized blockchain networks with expected first attacks in Metaverse– with major incidents relating to blockchain platforms, such as a vulnerability on Rarible marketplace or ApeCoin Airdrop vulnerability, we expect to see continued efforts by hackers to breach and hijack crypto assets. In addition, we believe that we will see initial attacks in the Metaverse that will exploit smart contract vulnerabilities.
Continue Reading

Cyber Security

Wipers and IoT Botnets Dominate the Threat Landscape, says Nozomi Networks

Published

on

The latest OT/IoT security report from Nozomi Networks Labs finds wiper malware, IoT botnet activity, and the Russia/Ukraine war impacted the threat landscape in the first half of 2022. Since Russia began its invasion of Ukraine in February 2022, Nozomi Networks Labs researchers saw activity from several types of threat actors, including hacktivists, nation-state APTs, and cyber criminals. They also observed the robust usage of wiper malware, and witnessed the emergence of an Industroyer variant, dubbed Industroyer2, developed to misuse the IEC-104 protocol, which is commonly used in industrial environments.

Additionally, in the first half of 2022, malicious IoT botnet activity was on the rise and growing in sophistication. Nozomi Networks Labs set up a series of honeypots to attract these malicious botnets and capture their activity in order to provide additional insights into how threat actors target IoT. In this research, Nozomi Networks Labs analysts uncovered growing security concerns for both hard-coded passwords and internet interfaces for end-user credentials. From January to June 2022, Nozomi Networks honeypots found:

  • March was the most active month with close to 5,000 unique attacker IP addresses collected.
  • The top attacker IP addresses wereassociated with China and the United States.
  • “root” and “admin” credentials were most often targeted and used in multiple variations as a way for threat actors to access all system commands and user accounts.

On the vulnerability front, manufacturing and energy continue to be the most vulnerable industries followed by healthcare and commercial facilities. In the first six months of 2022:

  • CISA released 560 Common Vulnerabilities and Exposures (CVEs)– down 14% from the second half of 2021
  • The number of impacted vendors went up 27%
  • Affected products were also up 19% from the second half of 2021

“This year’s cyber threat landscape is complex,” said Roya Gordon, Nozomi Networks OT/IoT Security Research Evangelist. “Many factors including increasing numbers of connected devices, the sophistication of malicious actors, and shifts in attack motivations are increasing the risk for a breach or cyber-physical attack. Fortunately, security defenses are evolving too. Solutions are available now to give critical infrastructure organizations the network visibility, dynamic threat detection, and actionable intelligence they need to minimize risk and maximize resilience.”

Nozomi Networks’ “OT/IoT Security Report” provides security professionals with the latest insights needed to re-evaluate risk models and security initiatives, along with actionable recommendations for securing critical infrastructure. This latest report includes:

  • A review of the current state of cybersecurity
  • Trends in the threat landscape, and solutions for addressing them
  • A recap of the Russia/Ukraine crisis, highlighting new related malicious tools and malware
  • Insights into IoT botnets, corresponding IoCs and threat actor TTPs
  • Recommendations and forecasting analysis
Continue Reading
Advertisement


Follow Us

Trending

Copyright © 2021 Security Review Magazine. Rysha Media LLC. All Rights Reserved.