The evolution of ransomware
Outwardly, ransomware in 2023 looks much as it did a year or two ago; there’s a lot of it around and despite governments advising against paying ransoms, many victims are still handing over substantial sums to the criminals. However, it’s clear that its evolution continues apace. On the criminal side, two trends are discernible. The first is the established trend of multi-vector extortion in which attackers not only encrypt data but steal it and threaten to expose it. This is backed up with threats to contact third parties affected by a breach and perhaps a nasty Distributed Denial-of-Service (DDoS) attack thrown in for good measure.
A second tactic is to focus exclusively on data theft for extortion, as seen in the zero-day compromise of Progress Software’s widely used MOVEit file transfer gateways. To work, this approach requires scale, which MOVEiT’s 1,700 enterprise customers offer. For the price of a single compromise, you can extort large numbers of victims. The Clop ransomware group claimed the attack, telling a website that it had moved on from encryption attacks.
On the defending side, the debate over whether to pay extortionists remains, with hints from the Biden administration that it might ban at least some ransom payments.
Business Email Compromise (BEC) fraud
With all the headlines grabbed by ransomware attacks, the threat from BEC fraud tends to get overlooked and yet it is evolving just as rapidly. Part of the problem is that BEC attacks are by their nature less obvious.
During 2022, the FBI’s IC3 complaint centre recorded an astonishing 21,832 BEC incidents which resulted in losses of more than $2.7 billion, far surpassing U.S. ransomware losses. A big part of BEC’s continued success is that it is now deployed via powerful platforms which specialise in this type of attack. These allow attackers to automate a range of techniques for compromising credentials (BEC is still about breaking into email systems to impersonate legitimate users), defeating geographical blocks on non-local IP addresses using residential proxies, and executing sophisticated forms of social engineering.
Read about the top 8 cyber security risks for businesses
API attacks – cyber criminals spot a new opportunity
Behind every great web lies an application programming interface (API). In truth, it’s probably dozens when you add up all the third-party APIs that are now in use. In 2019 content delivery giant Akamai estimated that 83% of all web-related traffic was to and from APIs. If you don’t use multiple APIs in 2023, you’re probably not in business.
APIs started as tools to make programming easier, but they have become integral to sharing and selling data, birthing the modern software and data economy. However, this API proliferation has come at the cost of security. APIs are software gateways that can suffer from many of the same software and authentication vulnerabilities as normal applications.
Criminals have noticed this, which has resulted in a series of hacks and scraping attacks. Many organisations now use so many APIs (including forgotten ones), that they have lost track of them, creating weaknesses that security teams struggle to manage.
Read about the biggest cyber attacks, year by year.
Multi-factor authentication – still essential, but not foolproof
Today, credentials are probably the biggest universal vulnerability. Attackers devote huge resources to stealing them, knowing that they offer a way to impersonate legitimate users in order to bypass layers of network security. The answer to this problem is multi-factor authentication (MFA), which requires the users to enter an extra credential (a code or present a token) to gain access to an account. Without a doubt, MFA works; numerous surveys show that accounts without MFA turned on are far more likely to be breached.
The caveat is that some types are more secure than others. For example, FIDO2 tokens are extremely secure, while codes sent via SMS text messages aren’t. Increasingly, criminals are finding ways to game MFA or even bypass it altogether. MFA fatigue attacks are a prime example in which attackers who have stolen account passwords bombard their owners with fake push notifications until they click ‘yes’ in exasperation. Worse still, attacks that steal session cookies bypass MFA completely, rendering even the most secure forms moot.
AI disinformation
We’re still in the early stages of artificial intelligence (AI) and its impact on cyber security, but some troubling scenarios are plausible. AI’s potential to create deep fakes and disinformation is advancing faster than the ability of humans and social media to understand this is happening. The incentive to use AI in this way is overwhelming. Conflicts between nations are increasingly fought through information v disinformation, in which the latter drowns out and confuses people’s understanding of real information.
So far, disinformation has mostly targeted countries but there is no reason it couldn’t be used against organisations or individuals too. Disinformation is a lot older than AI, but AI’s appearance makes it much easier to utilise at scale.
