Just like every coin has two sides, technological advancement has its dark side. The world has become smaller and more connected with technology, but this has also made us more vulnerable to cybercrimes.
Since the war between Ukraine and Russia that started in February, there has been an increase in cyber-attacks at an alarming rate. According to a report titled Microsoft Defence Report 2022, cyberweapons are being used in hybrid wars by countries like Russia, China, Iran, Lebanon and North Korea. The pandemic and the rapid growth of the Internet of Things (IoT) have increased the attack surface of the digital world allowing cyber criminals and nation-states to take advantage of Internet of Things (IoT) and Operational Technology (OT) devices.
There has also been a rise in hacktivism and industrialization of the cybercrime economy providing cybercriminals with sophisticated strategies, tools and infrastructure to expand their cybercriminal capacities. They are also compromising business networks to carry out phishing scams, spread malware and mine cryptocurrencies.
In this article, we aim to highlight what has led to the increase in cybercrime and the various strategies used by attackers to gain access to facilitate cybercrime. We will also talk about the best practices that can be used to ensure safety and protection. Below is a comprehensive list of the acts of cyber-attacks that companies face on a daily basis and how best to mitigate and defend against those attacks.
Major cyberthreats that businesses face in 2023
1. RaaS-Ransomware as a Service
Ransomware is malicious software that infiltrates your data and encrypts your files so you cannot access or read them. Cybercriminals then proceed to extort money to decrypt your files. Initially, ransomware attacks were typically managed by one gang, but not anymore. The system has further evolved and now includes separate entities such as access brokers, malware developers, criminal operators and affiliates and encryption and extortion service providers.
There has also been an increase in human-operated ransomware threats where cybercriminals make decisions at every stage of the attack, based on what they discover on their target’s network. These are by far one of the most difficult to predict and contain ransomware threats.
These attacks rely on security weaknesses such as poor cyber hygiene, like the lack of multifactor authentication and delays in updating patches. These attacks are orchestrated by individual operators resulting in varying attack patterns.
In recent times, ransomware has managed to infiltrate major companies as well as government organizations. It has become more important than ever for industries to better distinguish between ransomware developers and operators and understand the pre-ransomware phase and the ransomware deployment phase. Enterprises must adopt comprehensive security measures to mitigate attacks, including hardening capabilities and reducing alert volume.
What can be done to protect your business from RaaS?
- Maintain good cyber hygiene: Cyber attackers depend on security weaknesses, like infrequent patching or not implementing multifactor authentication.
- Do hardening: For ransomware attackers, monetary profit is the incentive. Hardening your internet-facing assets and the cloud will make conducting attacks more expensive, and as such act as a deterrent for them.
- Move to the cloud: Cloud platforms allow you to detect and respond to threats faster.
- Involve law enforcement agencies: It has been noted that cybercriminals tend to avoid platforms that easily trigger law enforcement. If you have been a victim of cybercrime and have paid through cryptocurrencies, then involve law enforcement so that they can help retrieve as well as track where the money has gone.
2. CaaS-Cybercrime as a Service
Cybercriminals are using legitimate infrastructure to operate phishing campaigns by using compromised sender accounts and Business Email Compromise (BEC) attacks to carry out scams, making it vastly difficult to detect them.
Phishing scams occur when a scammer sends an email masquerading as a reputable business or a person and acquires sensitive information, like account numbers, card details etc. When it comes down to phishing attacks, BEC is the most expensive financial cybercrime and is becoming a major threat to organizations. BEC and phishing are social engineering tactics where a scammer gains the trust of the target by establishing rapport and by using the help of homoglyphs where attackers create a spoof URL with similar-looking characters or create convoluted codes to further deceive their victims.
Cybercriminals are now collaborating across time zones and languages to deliver specific results and their operations span multiple jurisdictions presenting complex law and enforcement challenges. They use web shells and sophisticated platforms like remote desktop protocol (RDP), secure shell (SSH) and cPanels to conduct malicious activities.
What can be done to protect your business from CaaS Attacks?
It is important to maintain vigil and take measures to protect yourself from phishing scams by regularly reassessing your security solutions. It is important to block malicious emails and strengthen access control for user accounts.
Intelligence companies have enhanced their listening systems to detect and identify CaaS offerings across entire ecosystems of the internet, deep web, vetted forums, dedicated websites, online discussion forums and messaging platforms.
They are also focusing their efforts on disabling malicious criminal infrastructures that are being used to facilitate CaaS attacks. They are also collaborating with law enforcement agencies around the world to hold criminals accountable.
3. Hacktivism
One of the main reasons for the rise in cybercrimes around the world has been geopolitics. With the war between Russia and Ukraine, hackers from around the world have been infiltrating networks in both countries and causing disruption. This form of cybercrime is known as hacktivism, where a group of people who believe in a cause, hack into systems of the opposition and hinder their operations.
4. Nation State Threats
In the aftermath of geopolitical disturbances, there has been an increase in the activity of Nations State Threats (NST). The criminals are launching complex cyber-attacks to achieve their strategic goals. The deployment of cyber weapons in the hybrid war in Ukraine has marked a new era of conflict, where propaganda is being used to influence opinions globally. Lessons learned from this conflict, emphasize the importance of cloud security and the use of advanced technologies like Artificial Intelligence (AI) and Machine Learning (ML) to defend against cyber-attacks.
NST actors from countries like Russia, China, North Korea, Iran and Lebanon have become more active and are targeting a wider range of sectors including the IT supply chain infrastructure, IT transportation and communication. According to a study, it has been noted that most of these attacks have been against the US and UK.
The need of the hour is to maintain strong cyber security hygiene to mitigate risks and have a consistent global framework that prioritizes human rights and protects people from reckless state behaviour online.
What can be done to protect your business from Nation State Threats?
- It is important to identify and protect data targets, at-risk technologies, information and business operations that might be highly valuable to nation-state groups.
- Use cloud protection strategies to identify and mitigate known and novel threats to your network.
- Prioritize implementing Zero-day vulnerability patches as soon as they are released.
5. Risk to Devices and Infrastructure
The digital world has seen significant changes in recent years, with organizations adopting internet-facing devices and cloud technology to improve operations. This trend has also created an increased attack surface that threat actors exploit, particularly in the IoT and operational technology spaces, leading to an increased risk of critical infrastructure disruptions. To address this, policymakers are developing regulations such as Australia’s new laws and the EU’s proposed NIS 2 and Digital Operational Resilience Act (DORA).
What can be done to protect your devices and infrastructure?
- Network defenders can implement continuous monitoring of devices or implement a security monitoring solution to improve their organization’s security posture.
- Reduce attack surfaces by eliminating unnecessary internet connections, open ports, restricting remote access and using VPN Services.
- Ensure that Industrial Control System (ICS) protocols (instruments and systems that are used for controlling and monitoring industrial processes) are not exposed directly to the internet.
There is also an increased security risk associated with web-based exploits, botnets and OT-specific attacks on critical infrastructure. To protect your infrastructure, follow the practices below.
- Avoid transferring files that contain system definitions through unsecured channels.
- Proactively conduct incident response for OT networks.
- Deploy continuous monitoring, like Microsoft’s Defender for IoT.
6. Cyber Influence Operations
We are no stranger to the effects of social media in the modern times. Synthetic media is being used to influence and cause confusion in the population. While AI is being used to generate fun and exciting media content, some people are using it to spread harmful content that jeopardises people, businesses, institutions and society. An example of such technology is “cheap fakes” which can make damaging changes to content like adding misleading text, face swapping, removing or altering text and more.
What can be done to protect your business from cyber influence operations?
- Using Digital Provenance Technology provides a record of the people or systems that have handled the document. It helps to protect important data and official communications.
- Proactive steps need to be taken to protect the organization from misinformation threats by proactively considering your PR and communication responses.
The importance of Cyber Resilience
Cyber Resilience is the ability of a company to ensure business and operation continuity along with growth despite cyber criminals trying to impede their business through cyberattacks.
This can be achieved by following the Zero-Trust Architecture and by using a holistic and adaptive approach to tackle the ever-evolving cyber threats. Below are some ways you can leverage to protect your business and ensure operational continuity.
What can be done to ensure that your company is cyber-resilient?
- Follow Cyber Hygiene.
- Understand the advantages and disadvantages of digital transformation and what vulnerabilities can be exploited.
- Proactively block known attacks and repair the damages.
- Use fault isolations techniques to decrease the extent of the impact and reduce downtime. According to a study conducted by Gartner, organizations that use isolation techniques will be exposed to 25% fewer successful attacks by 2023.
- When planning projects, prepare for potential threats alongside opportunities.
Conclusion
Cyberthreats are evolving at an unprecedented rate and the recent geopolitical situations are making matters worse. While earlier countries were taking strict actions against cyber criminals on their soil, with the current disturbances, these cyber criminals are being encouraged and being used for their own agenda.
Cyber safety is a shared responsibility. It is the responsibility of every individual, organization, and government to proactively prevent these cybercrimes and work towards minimizing the damages.
