Connect with us

Cyber Security

Global Political Events and Accessibility of new Tech will Breed Innovative Threat Actors

Published

2 years ago

on

Written by Manoj Reddy, Rhonda Leopold & Max Kersten, researchers at Trellix Advanced Research Center

When protecting digital estate, companies search high and low for the right talent. In recent years, as cybersecurity has increased in importance in the Gulf region, we have often discussed the scarcity of that talent. Now we fear that our digital adversaries may be recruiting it for the same reason that regional SOCs have: to enhance a skills base and become more innovative.

More and more teen cybercriminals are getting involved with what can now only be described as professional criminal enterprises. As a result, cyber gangs are now firms with reputations and products. They are part of a wider ecosystem that is innovating much as legitimate enterprises do. Frontline operators use soft skills, backed by predesigned malware kits that are often offered in aaS-style subscriptions. Remember that Lapsu$, a group that made trouble for some big names, appeared to do so without ever dropping any malware. Attackers are changing and we must allow for this. Here are some major developments that CISOs should note.

Hacktivism moves to the center stage
For many years the headlines have been dominated by state-sponsored and financially motivated cyber threats. Hacktivism — politically or socially motivated hacking by activists — has remained in the background in recent years. Given current global tensions, we are already seeing the re-emergence of Hacktivism and expect this to play a larger part in 2023. As groups of loosely organized individuals, fueled by propaganda align for a common cause, they may continue to ramp up their use of cyber tools to voice their anger and cause disruption.

Patriotic hacktivism has increased in 2022 as war and other conflicts continue, and it breaks down into broad streams of actions like DDoS attacks, defacements, doxxing, intrusions, and leaking of personally identifiable information (PII). Hacktivists are targeting a wide range of industries and sectors that don’t align with their ideological and political views, including the telecommunication, energy, aviation, technology, media, and government sectors.

As tensions in 2023 are expected to rise, we expect hacktivism to continue to scale as it suits the political agenda of opposing parties and offers perfect plausible deniability for actions since they are initiated and undertaken by activists.

Increasing activity by teen cybercriminals at every scale
We are seeing technically talented young people being recruited by bad actors and organizations. Beginning in late 2021 a 16-year-old allegedly led successful hacks of international organizations like Microsoft, NVIDIA, Okta, and Samsung under the guise of the Lapsus$ gang. These cybercriminal organizations are today the talent competition of Fortune 500 companies and security companies who all work to protect society online.

In 2023, we expect to see increased activity from teens and young adults — everything from large-scale attacks on leading organizations to low-level crime targeting family, friends, peers, and strangers to make a quick buck, cause embarrassment, test new skills, and gain social capital. This problem may grow, budget increases will follow, and costs will continue to be handed back down to us as consumers. Teaching children what a crime is on the keyboard is essential.

There are some global initiatives to help prevent our youngsters from sliding off into a world of cybercrime. To educate the young on the dangers of cybercrime, there are some new initiatives like Hackshield that teach kids about the dangers of gaming. But the generational gap needs to be addressed and parents need to be educated to ensure they are leading their children away from petty cybercrime or even more nefarious crimes.

Declining accuracy of code-based attribution
With regard to cybersecurity, attribution is often heavily based upon dissected malware samples. It has been proven time and again that coding styles can be linked to actors, much like someone’s handwriting.

Attribution purely based on code alone can, however, pose a problem. Whereas advanced espionage groups are often known to create their own tooling for their campaigns to preserve their secrecy, some other malware types do not require such secrecy per se. Prime examples of such malware are wipers.

Once a wiper is used, it isn’t novel anymore, and the detection and prevention of malware are bound to be implemented. The creation of malware is often thought to be done by coders, who then sell the malware-as-a-service, or work with affiliates. Creation can also be outsourced to legitimate contractors, thus obscuring the code base attribution immensely, as the contracted authors have different coding styles.

The decrease in accuracy of code-based attribution, albeit seemingly insignificant on its own, is likely to become more problematic in the future, especially when taking the re-use of (leaked) malware source code and the collaboration between actors in the segmented underground into account. We, therefore, urge analysts to include their confidence level when making claims that aren’t (fully) supported by facts. This provides a clear indication to the reader with regards to the way the report should be perceived, allowing the appropriate actions to be taken from the get-go.

Skill up or get out-skilled
The cybercrime industry is fishing for talent just as the cybersecurity industry is. Facing competition, one must compete. We must look to the employee experience when attracting security talent, being mindful of the allure of shadowy worlds. We must make the SOC more attractive than the digital back alleys that beckon our young talent. We must equip them with tools that allow them to innovate and add value.

Meanwhile, we must look inward. For those employees that show interest and skill in cybersecurity, we must find the budget and invest in them. This is a war. We will not win it by conscription. We must equal the bad actors for their capacity to incentivise innovation. If we do not, they will outmatch us at every turn.

Related Topics:
Continue Reading

Cloud

SentinelOne Simplifies Secure Cloud Migrations on AWS

Published

23 hours ago

on

June 13, 2025

By

SentinelOne today announced its participation in the Amazon Web Services (AWS) Independent Software Vendor (ISV) Workload Migration Program. This initiative supports AWS Partner Network (APN) members with SaaS offerings on AWS to accelerate and streamline workload migrations.

Through the program, SentinelOne will provide AWS customers with accelerated, secure cloud migration support, leveraging modern AI-powered CNAPP capabilities to ensure rapid and protected transitions. With access to AWS funding, technical resources, and go-to-market support, SentinelOne will help organizations reduce migration timelines and costs while maintaining robust security.

SentinelOne’s Singularity Cloud Security delivers real-time visibility and protection throughout the migration journey—whether from on-premises or another cloud—enabling a secure, seamless transition to AWS.

“Through our participation in the AWS ISV Workload Migration Program, SentinelOne is helping customers accelerate secure cloud migrations with end-to-end protection and visibility,” said Ric Smith, President of Product, Technology, and Operations at SentinelOne. “Whether moving from on-prem or another cloud to AWS, organizations can count on us to deliver the security they need throughout their journey—realizing the performance, speed, agility, and cost benefits of the cloud.”

Singularity Cloud Security combines agentless and agent-based protection for deep visibility, continuous posture management, and real-time threat detection across hybrid and multi-cloud environments. By collaborating with AWS and ecosystem partners, SentinelOne ensures seamless integration into migration projects, helping customers move faster, reduce risk, and scale confidently in the cloud.

Availability: SentinelOne’s solutions are available globally.

Continue Reading

Cyber Security

Beyond Blocklists: How Behavioural Intent Analysis Can Safeguard Middle East Businesses from Rising AI-Driven Bot Threats

Published

4 days ago

on

June 10, 2025

By

The Middle East is facing an unprecedented surge in AI-driven bot attacks, with malicious automation now outpacing traditional defenses. Mohammad Ismail, Vice President for EMEA at Cequence Security, warns that legacy tools like IP blocklists and rate limiting are no match for today’s sophisticated threats (more…)

Continue Reading

Cyber Security

Sophos Boosts Firewall with New Protection and Incident Response Features

Published

4 days ago

on

June 10, 2025

By

Sophos has announced a significant update to its Sophos Firewall software, introducing enhanced protection and incident response capabilities. This update notably includes Sophos NDR Essential, a new feature now available free of charge to all customers holding an XStream Protection license for Sophos Firewall.

This integration empowers Sophos Firewall with two dedicated artificial intelligence (AI) engines specifically designed to detect both malware communications and those utilizing algorithmically generated domain names. This advanced functionality, derived from the Sophos Network Detection and Response (NDR) probe, aims to identify sophisticated malware communications even if they are previously unknown or not yet indexed. It serves as a powerful complement to the Active Threat Response capabilities already embedded within Sophos firewalls.

Chris McCormack, Senior Product Marketing Manager at Sophos

Addressing the technical demands of such advanced detection, Chris McCormack, Senior Product Marketing Manager at Sophos, explained the strategic approach, “NDR traffic analysis requires substantial processing power. That’s why we’ve adopted a new approach by deploying an NDR solution in Sophos Cloud to offload the heaviest tasks from the firewall.” This cloud-centric design ensures optimal performance without burdening the firewall’s on-device resources.

Beyond network detection, the update also brings significant improvements to connectivity and user authentication. Sophos Connect now integrates EntraID for Single Sign-On (SSO). This new feature for the VPN client, bundled with Sophos Firewall, is set to enhance both the security and user experience for SSL and IPsec VPN connections. The integration with EntraID (Azure AD) enables users to authenticate and leverage multi-factor authentication for both Sophos Connect and access to the user portal hosted by the firewall, streamlining secure access.

Further VPN-related enhancements include:

  • Improved user interface and usability: Connection types have been renamed for greater clarity, with “site-to-site” now referred to as “policy-based” and tunnel interfaces as “route-based,” making configurations more intuitive.
  • Dynamic validation of the IP address pool: For VPN connections (SSL VPN, IPsec, L2TP, and PPTP), the system now dynamically validates the allocated IP address pool, helping to better resolve potential IP address conflicts.
  • Strict profile enforcement: IPsec profiles now exclude default values to ensure algorithm synchronization, effectively eliminating potential fragmentation of session negotiation packets that could otherwise prevent site-to-site VPN tunnels from being established.
  • Route-based VPN and SD-RED scalability: The system has been optimized to support up to 3,000 simultaneously established tunnels. Specifically, Sophos Firewall solutions can now manage up to 1,000 SD-RED site-to-site tunnels and connect up to 650 concurrent SD-RED devices.

Additional management improvements enhance administrative flexibility and search capabilities:

  • More flexible DHCP Prefix Delegation (IPv6 DHCP-PD): The system now supports a broader range of prefixes, from /48 to /64, improving compatibility with various internet service providers.
  • Router Advertisement (RA) and DHCPv6 server: These features are now enabled by default, simplifying IPv6 network setup.
  • Resizable table columns: The web admin interface continues its adaptation for ultra-wide screens, with many configuration pages now allowing users to resize columns as needed for improved usability.
  • Enhanced object search functionality: The search field within the SD-WAN routing configuration screen now supports more granular criteria, including route name, ID, objects, and object values like IP addresses and domains. Similarly, local ACL rules now also support object name and value searches, extending to content-based searches for more precise results.
  • Default configuration changes: To streamline initial setups, default firewall rules and rule groups previously created during new firewall deployments have been removed. The initial configuration now only includes the default network rule and MTA rules. Furthermore, the default firewall rule group and the default gateway probe for custom gateways are now set to “None” by default.

Sophos continues its commitment to cybersecurity through a “Secure by Design” approach, enhancing the intrinsic security of its firewalls. This methodology involves the containerization of specific features and rigorous integrity checks on critical operating system files using mathematical checksums. Any detected checksum mismatch triggers a potential compromise alert, enabling monitoring teams to proactively identify possible security incidents affecting the firewall OS integrity. This proactive detection allows incident response and development teams to react swiftly to critical security events.

This update is now available for manual download and deployment by customers with any Sophos Firewall equipped with a valid license.

Continue Reading
Advertisement

Follow Us

Trending

Copyright © 2021 Security Review Magazine. Rysha Media LLC. All Rights Reserved.