A new report on IBM Security’s annual X-Force Threat Intelligence Index finding shows that although ransomware’s share of incidents declined only slightly (4 percent) from 2021 to 2022, defenders were more successful in detecting and preventing ransomware.
Despite this, attackers continued to innovate with the report showing that the average time to complete a ransomware attack dropped from two months to less than four days.
The IBM Security X-Force Threat Intelligence Index tracks new and existing trends and attack patterns – pulling from billions of data points from network and endpoint devices, incident response engagements, and other sources.
According to the 2023 report, the deployment of backdoors, which allow remote access to systems, emerged as the top action by attackers last year. About 67 percent of those backdoor cases were related to ransomware attempts, where defenders were able to detect the backdoor before the ransomware was deployed.
“The uptick in backdoor deployments can be partially attributed to their high market value. X-Force observed threat actors selling existing backdoor access for as much as $10,000, compared to stolen credit card data, which can sell for less than $10 today,” it reports.
Read also: FAAC disburses N722.7b to FG, States, LGs
Thread hijacking saw a significant rise in 2022, with attackers using compromised email accounts to reply to ongoing conversations posing as the original participant. X-Force observed the rate of monthly attempts increases by 100 percent compared to 2021 data. Over the years, it found that attackers used this tactic to deliver Emotet, Qakbot, and IcedID, malicious software that often results in ransomware infections.
The IBM reports that “With phishing being the leading cause of cyberattacks last year, and thread hijacking’s sharp rise, it’s clear that attackers are exploiting the trust placed in the email. Businesses should make employees aware of thread hijacking to help reduce the risk of them falling victim.”
The number of cybercriminals targeting credit card information in phishing kits, however, dropped 52 percent, indicating that attackers are prioritising personally identifiable information such as names, emails, and home addresses, which can be sold for a higher price on the dark web or used to conduct further operations.
It also found that the common impact of cyberattacks in 2022 was extortion, which was primarily achieved through ransomware or business email compromise attacks. Europe was the most targeted region for this method, representing 44 percent of extortion cases observed, as threat actors sought to exploit geopolitical tensions.
Meanwhile, the proportion of known exploits relative to vulnerabilities fell by 10 percent from 2018 to 2022, due to the fact that the number of vulnerabilities hit another record high in 2022. The findings indicate that legacy exploits enabled older malware infections such as WannaCry and Conficker to continue to exist and spread.
Cybercriminals often target the most vulnerable industries, businesses, and regions with extortion schemes, applying high psychological pressure to force victims to pay. Manufacturing was the most extorted industry in 2022, and it was the most attacked industry for the second consecutive year. Manufacturing organisations are an attractive target for extortion, given their extremely low tolerance for downtime.
Ransomware is a well-known method of extortion, but threat actors are always exploring new ways to extort victims. One of the latest tactics involves making stolen data more accessible to downstream victims. By bringing customers and business partners into the mix, operators increase pressure on the breached organisation.
In addition, threat actors will continue experimenting with downstream victim notifications to increase the potential costs and psychological impact of an intrusion – making it critical that businesses have a customised incident response plan that also considers the impact of an attack on downstream victims.
