A Perfect Storm For Cybercrime

Uploaded on 2023-07-13 in NEWS-Cybersecurity News, FREE TO VIEW

Calling the past few years uncertain is a slight understatement. From the COVID-19 pandemic, through to record inflation, the exhaustive energy crisis, and the devastating war in Ukraine - so many drastic events have had a significant impact on global behaviour and livelihood.

Every time the world stops to give people a moment to catch their breath, it seems another crisis comes along to disrupt things even further. This has led some global experts to even go as far to describe the world as in a state of “permacrisis”.

The effect these events have bleed through into all facets of life, but from a cybersecurity aspect, the fallout can be even more significant. The ambient uncertainty arising from the unknown plays a huge part in the funding and resourcing behind security operations (SecOps) teams – especially when board members don’t fully understand why having robust cybersecurity tools is so important to protecting business interests.

Furthermore, we’ve also seen threat actors play into the geopolitical instability, utilising sophisticated spear-phishing techniques to target individuals in critical sectors. In some cases, these have been backed by foreign governments in an effort to further destabilise regional economies – we’ve seen this recently with China’s activity in Taiwan. The question arises as to how businesses can better protect themselves from this malicious activity.

New Threats Rising To The Surface

As the tools supporting cybersecurity teams grow more sophisticated, so do the tools utilised by threat actors in their initiatives. Recent research from Trellix found that growing attack surfaces comprise 34% of the challenges faced by CISOs in protecting their organisations. But how does the threat landscape take shape – from ransomware to email, network, and endpoint vulnerabilities?

It’s difficult to pinpoint the exact vectors that threat actors utilise in compromising victim systems. Over the past year, we’ve seen a significant increase in the exploitation of Living off the Land Binaries (LotLBins), with threat actors gaining access to IT infrastructure through existing, benign system tools.

With this, we’ve also seen a proliferation in the use of first and third party bespoke and open-source tools such as Ghidra. Unpredictability on the part of malicious groups is an increasingly leaned on tactic, but it reinforces the importance of security being at the forefront of business decisions.

According to CISOs across the globe, employee error, such as accidently downloading compromised files or clicking malicious URLs, directly led to 45% of breaches in 2022. Having a top-down, security minded culture is essential to ensuring all business units are informed about security procedure.

Since the start of the conflict between Ukraine and Russia, we’ve also seen increase in niche strategies employed by groups, such as hacktivism – the use of hacking skills to promote political or societal change. Whilst hacktivism isn’t a new trend, groups like Anonymous have existed for some time now, these world events have initiated a “call-to-action” so to speak, against perceived societal injustices.

Collaboration Is The Key Ingredient To Protection

The uncertain political and economic environment has triggered a paradigm shift in attitudes between nations and organisations. The state of permacrisis has been a catalyst for important partnerships between the public and private sectors. We’ve seen an increased coalition of data between large cybersecurity industry players like Microsoft, Cisco, Google and Trellix, leveraging intelligence with the Ukrainian government and NATO throughout 2022.

Increased activity between the Five Eyes alliance (Australia, Canada, New Zealand, the United Kingdom, and the United States), as well as the EU has helped in limiting the scale of state-backed cyberattacks.

The UK government has also recently announced it is strengthening its ties with Japan and Israel to enhance tech and security collaboration between the countries and reduce cyber risk. Whilst advanced persistent threat (APT) groups still remain active, partnerships like these have enabled companies and governments to be better prepared in the face of emerging threats.

Tracking major APT groups is an ongoing process. It requires the participation of government bodies and businesses to keep atop of the evolving threat landscape and minimise threats. Sharing intelligence with the NCSC and CISA, for instance, is an essential step in mitigating the impact of security breaches. To this end, the formation of groups like the NCSC’s Industry 100 scheme and the CISA’s Joint Cyber Defence Collaborative (JCDC) are facilitating a collaborative and fluid intelligence highway across public and private sectors.

Ever Looming State-backed Threats

In May, the APT Group known as Volt Typhoon mounted a massive cyberattack aimed at crippling US critical infrastructure. Whilst they deny involvement, evidence that China was involved in backing the group in their activities demonstrates the building tensions between the East and West. This coincides with our own findings within the recent Trellix CyberThreat Report, with China being the most prevalent threat actor country, contributing to 79% of state backed activity worldwide in Q1 2023.

The exploitation of LotLBins allowed Volt Typhoon to remain hidden amongst in-built systems on compromised computers. This enabled them to remain undetected whilst moving laterally through systems, expanding their threat surface. Often organisations will not even know there is a breach until it is far too late - investing in resources that enhance existing incident detection and response capabilities is crucial.

Cybersecurity is a shared problem. Robust, real-time sharing of threat data is key to protecting citizens and organisations from attack.

The mentality needs to be that “the enemy of my enemy is my friend” when it comes to true security collaboration to keep cybercriminals at bay.

Centralising Security Operations

There is pressure on SecOps in making do with the tools that are already in place. Much like spinning plates, too many siloed solutions can inadvertently take control away from security professionals and reduce overall security visibility.

Having a centralised system that covers email detections, endpoint, network protection and control over data migration offers greater protection.

This allows core vulnerabilities to be prioritised, whilst additional tools like AI and machine learning can be introduced for more automated detection and response. Agility and flexibility are key, as threat actors are always learning, adapting, and evolving their attack techniques. When faced with this challenge, agile cybersecurity defence based on frontline intelligence becomes crucial when defending against attacks across both public and private sectors.

Fabien Rech is Senior VP & GM EMEA of Trellix

You Might Also Read:

Overcoming The Obstacles Caused By The Great Resignation:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.