Connect with us

Market Research

Check Point Research Says Third Quarter of 2022 Reveals Increase in Cyberattacks

Published

on

This year has been largely dominated by the Russia-Ukraine war, with major concerns about its impact on the global threat level. Just three days after the invasion of Ukraine, on February 27th, Check Point Research (CPR) noted a 196% increase in cyber-attacks on Ukraine’s government-military sector and a 4% increase in cyber-attacks per organization in Russia.

It is not only war-related cyber activity that has seen a sharp rise over the last few months. It seems that hackers and attack groups have gained momentum and confidence, luring and attacking what seems to be endless targets around the globe. Check Point Research (CPR) reports that the third quarter of 2022 saw an average of 1,130 weekly attacks per organization globally, a 28% increase compared to Q3 2021, whereas the UAE observed an average of 996 weekly attacks per organization in Q3 2022 with the largest individual growth of a 151% increase YoY.

While there has been an increase this year, it has plateaued when compared to the sharp rise seen in 2021. This could be an indication of how enterprises and governments are addressing the risks by increasing investment in their cybersecurity strategies and putting a greater focus on finding and detaining hackers.

In a report published back in August 2022, CPR noted that the Education sector was experiencing more than double weekly attacks, compared to other industries. We have seen this trend continue, with the Education/Research sector facing an average of 2,148 attacks per organization every week in the third quarter this year, an increase of 18% compared to the third quarter last year.

Academic institutions have become a popular feeding ground for cybercriminals following the rapid digitisation they undertook in response to the COVID-19 pandemic. Many were ill-prepared for the unexpected shift to online learning, which created ample opportunity for hackers to infiltrate networks through any means necessary. Schools and universities also have the unique challenge of dealing with children or young adults, many of which use their own devices, work from shared locations, and often connect to public WiFi without thinking of the security implications.

The second most attacked industry was Government/Military, with 1,564 average weekly attacks, marking a 20% increase from the same period last year. The Healthcare sector saw the largest change compared to last year, with 1,426 average attacks per week – a significant increase of 60% YoY.

“In Check Point’s ‘Cyber Attack Trends: 2022 Mid-Year Report, our researchers pointed to ransomware as the number one threat to organizations, stepping up to nation-state actor levels. Overall, the number of ransomware attacks has fallen worldwide by 8% compared with the third quarter of 2021. This could be due to a shift towards alternative attack methods such as botnets and hacktivism. However, ransomware continues to garner the most public attention and cause the greatest disruption,” the company said.

The Healthcare sector was the most targeted industry in terms of ransomware in the third quarter of 2022, with one in 42 organizations impacted by ransomware, a 5% increase YoY. The second sector was ISP/MSP, where one in 43 organizations was impacted, a decrease of 25% YoY. This was followed by the Finance/Banking industry, where one out of every 49 organizations was affected by ransomware, indicating a 17% increase in the past year.

Ram Narayanan, Country Manager at Check Point Software Technologies, Middle East said, “Cyber threat actors continue to focus their efforts on targeting hospitals, largely because of intense pressure for these organizations to respond fast. A cyber attack on a hospital can lead to potentially catastrophic consequences, such as delayed surgeries, hold-ups in patient care, and rescheduled doctor appointments. In fact, our latest threat intelligence report shows that Healthcare is the most impacted industry in the UAE with 2178 weekly attacks per organization in the last 6 months. Even if an attack doesn’t shut a hospital down, it can knock some or all digital systems offline, cutting doctors’ and nurses’ access to digital information like patient records and recommendations for care. Hospital organizations should keep their programs up-to-date, only download items from known sources, and constantly back up their data. As we begin to close out the year and enter the holidays, hospitals should stay on high alert, as ransomware gangs love to strike during this period as staff begins to take time off.”

There are several best practices and actions a company can take to minimize their exposure to the next attack or breach. Prevention is possible:

  • Phishing emails are one of the most popular ways to spread ransom malware. By tricking a user into clicking on a link or opening a malicious attachment, cybercriminals can gain access to the employee’s computer and begin the process of installing and executing the ransomware program on it. Frequent cybersecurity awareness training is crucial to protecting the organization against ransomware. This training should instruct employees to do the following:
    • Do not click on malicious links
    • Never open unexpected or untrusted attachments
    • Avoid revealing personal or sensitive data to phishers
    • Verify software legitimacy before downloading it
    • Never plug an unknown USB into their computer
    • Use a VPN when connecting via untrusted or public Wi-Fi
  • Keeping computers and servers up-to-date and applying security patches, especially those labelled as critical, can help to limit an organization’s vulnerability to ransomware attacks.
  • Keep your software updated. Ransomware attackers sometimes find an entry point within your apps and software, noting vulnerabilities and capitalizing on them. Fortunately, some developers are actively searching for new vulnerabilities and patching them out. If you want to make use of these patches, you need to have a patch management strategy in place—and you need to make sure all your team members are constantly up to date with the latest versions.
  • For some businesses, it may be beneficial to employ the help of tools that fortify endpoint resilience and secure remote users.
  • Anti-ransomware technology allows you to detect signs of ransomware and uncover running mutations of known and unknown malware families by using behavioural analysis and generic rules.
  • Modern email filtering solutions can protect against malware and other malicious payloads in email messages. Solutions can detect emails that contain malicious links, attachments, spam content, and language that could suggest a phishing attack. Email security solutions automatically block and quarantine suspicious emails and use sandboxing technology to “detonate” emails to check if they contain malicious code.
  • Traditional cybersecurity vendors often claim that attacks will happen, and there is no way to avoid them, and therefore the only thing left to do is to invest in technologies that detect the attack once it has already breached the network and mitigate the damage as soon as possible. This is not true. Not only can attacks be blocked, but they can be prevented, including zero-day attacks and unknown malware. With the right technologies in place, most attacks, even the most advanced ones, can be prevented without disrupting the normal business flow.

Market Research

Trellix Predicts Heightened Hacktivism and Geopolitical Cyberattacks in 2023

Published

on

Trellix has released its annual threat predictions report for 2023. Forecasts from the Trellix Advanced Research Center anticipate spikes in geopolitically motivated attacks across Asia and Europe, hacktivism fueled by tensions from opposing political parties, and vulnerabilities in core software supply chains. “Analysing current trends is necessary but being predictive in cybersecurity is vital. While organizations focus on near-term threats, we advise all to look beyond the horizon to ensure a proactive posture,” said John Fokker, Head of Threat Intelligence, Trellix. “Global political events and the adoption of new technology will breed novel threats from more innovative threat actors.”

The Trellix Advanced Research Center brings together hundreds of the world’s most skilled security analysts and researchers to serve the global threat intelligence community and organizations with the latest threat indicators and insights collected from Trellix’s extensive sensor network. Trellix Advanced Research Center forecasts the following threats in 2023:

  • Geopolitics and grey-zone conflict. Geopolitical factors will continue to be a high motivation for misinformation campaigns and cyberattacks timed with kinetic military activity.
  • Hacktivism takes center stage. As groups of loosely organized individuals fueled by propaganda align for a common cause, they will ramp up their use of cyber tools to voice their anger and cause disruption across the globe.
  • Skeletons in the software closet will multiply. Both threat actors and security researchers will heighten their study of underlying software frameworks and libraries resulting in an increase in breaches related to software supply chain issues.
  • Increasing activity by teen cybercriminals. Teens and young adults will engage at increasing levels in cybercrime – everything from large-scale attacks on enterprises and governments to low-level crimes that target family, friends, peers, and strangers.
  • Declining accuracy of code-based attribution. The outsourcing of malware creation and operation, diversification of malware development, and use of leaked source code will make attribution of cyberthreats to specific threat actors increasingly challenging.
  • Imminent global cyberthreat to critical infrastructure as cyberwarfare evolves. A significant rise in advanced cyberactors causing disruptions to critical infrastructure in vulnerable targets will be observed.
  • With more collaboration comes more phishing. Weaponised phishing attacks will increase across commonly used business communication services and apps, like Microsoft Teams, Slack, and others.
  • “Alexa, start mining bitcoins.”The advanced capabilities of consumer and enterprise IoT devices will be leveraged by hackers to mine cryptocurrencies.
  • Space hacking: only going up from here. The compromise of satellites and other space assets will increase and become more public in 2023.
  • Here’s my number, so call me, maybe. There will be a huge jump in reverse vishing – or voice phishing – attacks, with fewer tech-aware users being the primary target.
  • Attacks against the Windows domain will scale. More domain privilege escalation vulnerabilities will be discovered as well as more real-world attacks against Microsoft Windows with the explicit goal of complete network takeover.

“We started 2022 with an industry-wide vulnerability in Log4J, which was closely followed by cyber and physical war targeting Ukraine. We’re closing the year observing hacktivists taking matters into their own hands, new actors in operation, and a changed but increasingly active ransomware landscape. As stress continues to weigh on the global economy, as we head into the new year, organizations should expect increased activity from threat actors looking to advance their own agenda – whether for political or financial gain,” commented Vibin Shaju, VP EMEA, Solutions Engineering, Trellix. “To outwit and outpace bad actors and advance defenses proactively, security must be always-on and always learning.”

Continue Reading

Market Research

North Korea-Linked Group Launches Dolphin Backdoor: ESET Research

Published

on

ESET researchers analyzed a previously unreported sophisticated backdoor used by the ScarCruft APT group. The backdoor, which ESET named Dolphin, has a wide range of spying capabilities, including monitoring drives and portable devices, exfiltrating files of interest, keylogging, taking screenshots, and stealing credentials from browsers. Its functionality is reserved for selected targets, to which the backdoor is deployed after the initial compromise using less advanced malware. Dolphin abuses cloud storage services — specifically Google Drive — for Command and Control communication.

ScarCruft, also known as APT37 or Reaper, is an espionage group that has been operating since at least 2012. It primarily focuses on South Korea, but other Asian countries have also been targeted. ScarCruft seems to be interested mainly in government and military organizations, and companies in various industries linked to the interests of North Korea.

“After being deployed on selected targets, it searches the drives of compromised systems for interesting files and exfiltrates them to Google Drive. One unusual capability found in prior versions of the backdoor is the ability to modify the settings of victims’ Google and Gmail accounts to lower their security, presumably to maintain Gmail account access for the threat actors,” says ESET researcher Filip Jurčacko, who analyzed the Dolphin backdoor.

In 2021, ScarCruft conducted a watering-hole attack on a South Korean online newspaper focused on North Korea. The attack consisted of multiple components, including an Internet Explorer exploit and shellcode leading to a backdoor named BLUELIGHT.

“In the previous reports, the BLUELIGHT backdoor was described as the attack’s final payload. However, when analyzing the attack, we discovered through ESET telemetry a second, more sophisticated backdoor deployed on selected victims via this first backdoor. We named this backdoor Dolphin based on a PDB path found in the executable,” explains Jurčacko.

Since the initial discovery of Dolphin in April 2021, ESET researchers have observed multiple versions of the backdoor, in which the threat actors improved the backdoor’s capabilities and made attempts to evade detection.

While the BLUELIGHT backdoor performs basic reconnaissance and evaluation of the compromised machine after exploitation, Dolphin is more sophisticated and manually deployed only against selected victims. Both backdoors are capable of exfiltrating files from a path specified in a command, but Dolphin also actively searches drives and automatically exfiltrates files with interesting extensions.

The backdoor collects basic information about the targeted machine, including the operating system version, malware version, list of installed security products, username, and computer name. By default, Dolphin searches all fixed (HDD) and non-fixed drives (USBs), creates directory listings, and exfiltrates files by extension. Dolphin also searches portable devices, such as smartphones, via the Windows Portable Device API. The backdoor also steals credentials from browsers, and is capable of keylogging and taking screenshots. Finally, it stages this data in encrypted ZIP archives before uploading it to Google Drive.

Continue Reading

Market Research

Kingston Reiterates the Role of Encrypted Hardware in Mobile Healthcare Data Security

Published

on

Kingston Technology Europe has emphasised the importance of hardware-based encryption in strengthening mobile healthcare data protection efforts across the globe. The company made the statement as data breaches remain one of the biggest digital threats within the healthcare industry, thereby raising the need for stronger data security protocols and stringent compliance with relevant policies.

The average total cost of a healthcare data breach worldwide rose by almost $1 million to reach $10.10 million in 2022, according to IBM Security analysis of research data compiled by Ponemon Institute. Healthcare breach costs have been the most expensive industry for 12 consecutive years, increasing by 41.6% since the 2020 report.

Kingston maintained that hardware encryption can help bridge gaps by providing a fortified layer of data protection through an encryption process designed to be unbreakable or hard to intercept. Whether stored or transported, the medical data saved in encrypted hardware devices such as USBs can be accessed only through authentication codes set by authorised individuals.

The encryption feature is also separate from any PC, mobile phone, or network systems to keep the data out of reach in the event cybercriminal breaks into the gadgets or online networks. Security is also assured even if the encrypted device ends up being misplaced, lost, or stolen. “Encrypted drives such as IronKey encrypted USBs are made to keep the data from falling into the wrong hands. Many are equipped with top-notch features that can also detect and respond to physical tampering and provide automatic data protection upon drive removal for added peace of mind,” said Antoine Harb, the Team Leader for Middle East and North Africa at Kingston Technology.

“Such capabilities are vital given that human error is considered one of the common causes of data breaches. One recent example took place in Japan where a worker reportedly lost a memory stick that contained the personal data of all residents of a Japanese city after a night out. The data had been encrypted and password-protected, preventing unauthorized access, Hardware-based encryption not only offers strong and reliable protection but is also a practical and easy-to-use approach to safeguarding private healthcare-related information,” added Harb.

According to Harb, it offers out-of-the-box cybersecurity measures minus the need for regular updates like those required in the software-based encryption processes. “Cybercrimes are on the rise worldwide, resulting in astronomical financial and reputational costs. In the Middle East, IBM Security reported that the region had the second highest average total data breach cost reaching $7.46 million in 2022 from $6.93 million last year,” the company said.

Among other factors, the Middle Eastern countries’ financial and economic status has been cited as one of the main reasons behind the online network attacks. In the Gulf region, the attacks on Dubai-based NHS Moorfield Hospital and GlobeMed Saudi were considered one of the top breaches in the UAE and Saudi Arabia, respectively.

Calls for improved data security levels are, therefore, mounting. Across the globe, laws, and regulations, including the General Data Protection Regulation, have already been enforced for a higher level of data privacy and security. In the UAE, the government has also imposed strict compliance of healthcare providers with its Health Data Law. “We can only expect that online network intrusions will grow and become even more sophisticated and bold as the world transitions to an ultra-connected society. Implementing or using encrypted devices is an important cybersecurity protocol that both individuals and corporations can adopt for stronger and easier-to-use data protection. Understanding one’s needs and, in the case of healthcare providers, knowing the importance of protecting the patients’ private mobile data, among others, play an important role in choosing the right encrypted hardware,” Harb added.

Continue Reading
Advertisement

Follow Us

Trending

Copyright © 2021 Security Review Magazine. Rysha Media LLC. All Rights Reserved.