Magazine menu Close Magazine menu

Threat intelligence

Latest stories

cybersecurity predictions

What a year of changing cyberthreats can tell business

  • min read
    • For business leaders, knowing what's changing in cybersecurity helps you recruit the right people with the right skills today for what you'll soon need. Kaspersky's 2022 Security Bulletin (free download) analyzes which attacks their global cloud service Kaspersky Security Network (KSN) has detected, blocked and disabled over the past year. There are some numbers your business will want to know about. 15 percent of users had a malware attack Kaspersky Security Network blocked malware-class attacks on some 15 percent of users in 2022, or around 1 in 7. This shows just how common malware is. The malware class of attacks covers familiar cybercrime tools like viruses, trojans and ransomware. The countries where Kaspersky's software blocked the most malware attacks in 2022 were Tunisia, Taiwan and Algeria. 506 million web-based attacks Web-based attacks result from users downloading files that then trigger a cyberattack. These might come from websites made by cybercriminals, infected online resources within user-created content (like online forums) or legitimate resources that cybercriminals have hacked. Cybersecurity education can be a powerful tool in preventing web-based attacks. Heathrow Airport has a novel staff cybersecurity education that carefully targets those needing it most with 10-minute online learning modules. 1.4 million cryptocurrency mining attempts Cryptocurrency mining is very much on the rise. Kaspersky Security Network detected around 1.4 million attempts to install mining software in the past year. Mining means digitally solving complex mathematical problems that verify cryptocurrency transactions, which also earns cryptocurrency. It slows devices and uses much electricity. In November 2022, Kaspersky announced they'd seen a 230 percent growth in cryptocurrency mining in the third quarter of 2022 compared with the same period in the year before. 102 million attempts to visit malicious URLs Malicious URLs are a common tool in 'phishing' attacks – when cybercriminals send emails inducing recipients to click on links, downloading malware. Endpoint security is vital in protecting against phishing, as is employee cyber-awareness. 377,000 attempts to steal money These attacks were often in the form of 'banking Trojans'. In early 2022 a particularly sophisticated money-stealing Trojan popped up that masquerades as a banking app and imitates phone conversations with bank employees. The app fooled many, highlighting the need to teach employees 'cyber hygiene' – like remembering to pause and think before downloading anything. Those who provide legitimate apps or financial services might also reflect on how they can show customers their products are trustworthy. These big numbers in cybersecurity over the past year show how threats to business are growing and changing. Cybercriminals always find new ways to get through consumers' and employees' defenses. By combining hiring the right people with robust cybersecurity education and strong security solutions, your business will greatly reduce its chances of a serious attack succeeding. Then, you can spend your time on what you do best.
cybersecurity new team sport

Why cybersecurity is the new team sport

  • min read
    • The pace of technological change is accelerating, and we readily adopt its many advantages. But despite this massive technological change, approaches to the threats it brings have changed little. The result is, we're losing the battle against constant attacks and breaches. For CEOs and Chief Information Security Officers (CISOs,) history may supply an answer – not in the form of technological genius, but in the form of humanity. Our recent history and deepest past show why cybersecurity must become the new team sport. The futuristic wild west of IT When I started working with computers in the early 1980s, they were controlled by men with beards in woolen tank tops. They ruled from a refrigerated IT throne – refrigerated because the IT team would often share the room with servers that need to be kept cool – knowing everything that went on in their realm. If something happened that was not allowed, it was fixed and hidden from the outside world with a combination of embarrassment and corporate secrecy. Today, we're in more of a futuristic wild west. The business perimeter contains many more applications, devices and entry points. Specialist 'gun slingers' – in the form of CISOs – have the IT administrator's security responsibilities. Each tries their best to cope with the onslaught of potential threats – anything from a nation-state attack to an employee accidentally sending data somewhere they shouldn't. Start-up mentality not all it's cracked up to be "Fail fast" and "move fast and break things" are often hailed as mantras of tech start-up success. But history also shows bad people have these same mentalities. They don't worry about due diligence or putting new ideas and technologies through rigorous testing. They try anything they think will work without considering if it will breach compliance. Meanwhile, budget, resources and red tape often tie CISO hands. They can feel held hostage by a board that doesn't understand the need for rapid reaction to combat the latest advance in 'dark tech.' We've seen this challenge before Up to now, I've described a futile, dystopian, 'Mad Max' world. But I think the battles CISOs fight today are our history, not of our future. Companies, and those in cybersecurity, often call their critical data and intellectual property the 'crown jewels,' referencing the ceremonial treasures acquired by English kings and queens. Those crown jewels are protected by thick walls, with guards and few entry points – like how IT administrators guarded our data back in the 80s. CISOs are inevitably 'outgunned,' under-resourced and underfunded in a battle against an agile and risk-indifferent enemy. So how do we 'fight the good fight' and win? Again, history has answers. Early 1900s business theorist Harrington Emerson is sometimes paraphrased, "Methods are many, principles are few. Methods may change, but principles never do." So let's go back to first principles. We're stronger together Humans first formed settlements as they started farming some 14,000 years ago. Having individuals in these settlements with different skillsets and abilities facilitated their growth. Some of us have an aptitude for the cerebral, like designing and inventing. Others are more physical, excelling in building and protecting. Settlements developed when we used complementary skills to advance a common goal, like making a safer, more prosperous place to live. Settlements collaborated – sometimes merging, sometimes building coalitions. And in times of crisis, while a few favored 'everyone for themselves,' most joined together for the greater good. Charles Darwin said, "It is the long history of humankind (and animal kind, too) that those who learned to collaborate and improvise most effectively prevailed." History has countless examples of international teamwork, from expeditions into unchartered territory to the allied nations of World War II, and more recent history. COVID-19: Each taking on a little During the recent COVID-19 pandemic, as individuals, we took precautions to keep ourselves and our families safe. But our actions of self-isolation, social distancing and complying with lockdowns knowingly served to protect society. Some countries legally enforced these measures. In others, it was a request. Regardless, most adhered, each playing their part by taking on a little of the responsibility to keep everyone safe. Eventually, the infection rate dropped and with much help from modern medical science, the world could open up. During the pandemic, countries teamed up, sharing information about infections – different strains, different consequences and symptoms. The data grew as individuals and teams combined findings, leading to the creation of vaccines to reduce the impact of the virus. It didn't stop there – sharing goes on, so vaccines can be tweaked to ensure continued efficacy. Extrapolating from this, the roadmap for cybersecurity should see the CISO as part of a team – not just within one organization, but within a global network, openly sharing intelligence and insight. On the other side of the planet, a CISO who has seen similar adds more context. As the chain passes from CISO to CISO, value increases. Quantity and depth of data grow, like crowdsourced security. This level of open collaboration may sound far-fetched, but intelligence agencies worldwide have shared information on threats similarly since September 11, 2001. This operating model may be closer than we think. CISOs already attend lunches or drinks where they swap 'war stories' under the Chatham House rule: You may use the information, but you may not disclose its source. Cybersecurity researchers in different companies and institutions worldwide combine their findings, writing shared reports. We already collaborate this way, instinctively reaching out for help, as we did in the days of early human settlements, but mostly we do it individually. Corporate legalities and organizational culture tend to restrict rather than encourage inter-company information exchange – it doesn't have to be that way. History shows collaboration naturally happens between groups with a common cause, and today is no different. By encouraging CISOs, staff and researchers to exchange knowledge and skills through a system for sharing threat information, we can nurture the communication of cooperation. We are better together, and together we can play the new team sport of cybersecurity.
cyber threats business 2022

Five business cyberthreats taking center stage in 2022

  • min read
    • Every year, businesses face a changing threat landscape. It pays for leaders to know what the experts think will come next. If you're upgrading your cybersecurity or looking for a new vendor, knowing what attacks are likely in 2022 will help you make the right choice. It turns out our predictions for 2021 were on the money. So what should you and your colleagues plan for this year? We're forecasting these four events that could have flow-on effects for other industries. 1.  Financial organizations will face more threats around cryptocurrency Cryptocurrency keeps growing, and people will keep investing in it for many reasons, including its anonymity, which also makes it attractive to cybercrime groups. In the scramble for cryptocurrency investment opportunities, cybercriminals will use social engineering campaigns, fabricating and selling rogue devices with backdoors to steal financial assets. More financial industry cyberthreats we'll see in 2022 2.  Fake medical documentation will trouble healthcare We saw the trade in faked medical documents like COVID-19 vaccination passports and test results in 2021. Fake vaccines were even spotted for sale on the dark web. As more countries roll out privileges alongside vaccination or test documentation, criminals will roll out more fakes. Medical-themed bait has long featured in cybercrime. With the pandemic triggering increased use of online medical services, patients watch for notifications about test results and messages from doctors. More healthcare cyberthreats likely in 2022 3.  Governments will conflict and compromise with big tech Governments are wary of big tech's growing power and data hoarding. As states build more digital infrastructure for delivering services and deeper insights into their population, they'll show more interest in what citizen data big business holds. We'll see more regulation, such as privacy and data localization laws, and regulation around how law enforcement can access data. Apple's new system that scans devices for child abuse images shows the challenges of balancing user privacy against stopping crime. More privacy predictions for 2022 4.  Industrial attacks will become more focused In many parts of the world, a rapidly snowballing trend is laser-focused attacks, particularly on Industrial Computer Systems (ICS.) We've seen increasing theft of authentication data using spyware, with each attack directed at only a handful of targets. We think these kinds of attacks will make up an even greater portion of the threat landscape in 2022, and we'll see the tactic used more widely. These attacks show why industrial shop floors must be protected. Industrial internet of things (IIoT) devices are easily overlooked and often vulnerable. More predictions for industrial cybercrime in 2022 5.  Ransomware attacks will get more targeted 2021 was a big year in ransomware, with a 30 percent growth in Ransomware 2.0, also known as double extortion. These attacks go beyond demanding a ransom to de-encrypt systems to using stolen sensitive data as leverage to pressure victims to pay up. In November 2021, the US FBI warned ransomware actors are "using significant financial events, such as mergers and acquisitions, to target and leverage victim companies for ransomware infections." At these times, any leaked information could have devastating consequences, making victims more inclined to pay ransoms. In 2022, this type of extortion will become more common. Regular, high-quality cybersecurity training for all staff is one of the best ways of avoiding falling victim to ransomware. Kaspersky is one of several organizations behind the No More Ransom initiative, providing free decryption tools and advice for ransomware victims. More on ransomware activity in 2021 As your strategic plans for 2022 take shape, improving cybersecurity will no doubt be among them. Your business must adapt as cybercriminals' ways and means change. These predictions will help you and your team be forewarned and forearmed.
cybersecurity predictions 2021

What does 2021 have in store for cybersecurity?

  • min read
    • Predicting the future is notoriously precarious. Who would have foreseen a year like 2020? Kaspersky's Global Research and Analysis Team reflect on this year in cybercrime and deduce what we should expect in 2021. Leaked patient records and COVID pressures in healthcare 2020 was the year everyone had a vested interest in new medical technologies' success. Cybercriminals attacked medical devices, hospitals and research institutions, intent on stealing COVID-19 vaccine insights. We also saw the first known directly fatal cyberattack: A patient died because ransomware infection of medical equipment caused care delays. Other cybercrime groups surprised us by ruling out attacking medical institutions. The cybersecurity community set up CTI League: Experts helping medical organizations respond to cyberthreats. Kaspersky gave healthcare organizations free access to tailored cybersecurity. In 2021, expect more attacks on COVID-19 vaccine developers attempting to steal critical data that could help other nations get ahead. Private healthcare organizations will further come under attack, as many don't have the resources to protect valuable patient data. With the transition to cloud computing, we may see patient data leaks from cloud services. Criminals can use personal data in hacked medical records to dupe people into revealing more. More healthcare industry cybersecurity predictions for 2021 Cybercriminals have learned about industrial networks Attacks on industrial networks will become more targeted. By watching randomly infected machines, cybercrime groups have learned organizations' IT setup and know how to exploit it. They can then on-sell network access to more sophisticated cybercrime groups who will take control of finance systems to steal cash. As many industrial control systems (ICS) use old operating systems, the end of support for systems like Windows 7 creates an exploitable loophole. We could see another significant, multi-industry crime campaign like WannaCry. As utilities and government services go through digital transformation they're more vulnerable to attack. Cybercriminals can use a government service as an entry point into industrial systems to disrupt services like public transport. In 2020, COVID-19 restrictions on working on-site delayed IT-system upgrades. During an attack, it may be harder for IT admins to regain system control quickly. Basic malware could spread and become more serious. Upgrading endpoint security and training workers are vital. More industrial cybersecurity predictions for 2021 Online education revolution brought new threats Education changed abruptly in 2020. 1.5 billion students took classes from home. Educators had to learn new skills, like running a class on Zoom or using TikTok lessons. For those who can access the technology, these new services enhance education. But they come with new threats. Learning management systems (LMS) like Google Classroom are exploding. And with growth comes cybercrime. We saw a staggering 20,000 percent growth in threats to online learning platforms between 2019 and 2020. Privacy usually involves getting the user's consent, but a child can't easily manage their privacy settings. Video will keep growing as a learning tool. About 60 percent of teachers use YouTube in the classroom. There's increased risk of exposure to age-inappropriate content, and new threats like Zoombombing could expose learners to harmful content. Games like Minecraft are a great way to make learning more interactive but exposes students to risks like cyberbullying, trolls and malicious files. Teachers must moderate content in their learning management systems, but with the popularity of social platforms and games for pupil engagement, the challenge has leveled-up. More education cybersecurity predictions for 2021 Poverty driving more financial cybercrime in 2021 In 2021, financial companies became less secure thanks to due hastily deployed remote working solutions. Some bought retail laptops that didn't match the security standards of the organization. Limited employee training, default configurations and remote access all contributed to increased attacks. There's rising extortion using distributed denial of service (DDoS) and ransomware. Targeted ransomware is the new normal for financial organizations. Criminals increased ransoms, emboldened by successful attacks and media coverage. To cover their tracks, they'll now expect you to pay in cryptocurrencies. People are often the weakest link, like in the failed attempt to infiltrate Tesla. Stay at home orders didn't affect cybercriminals: Brazilian cybercrime groups went global in 2020, expanding to Europe and beyond, including attempts to hack ATMs. Bigger crime groups are evolving their business models to boost profits by hiring more people within their virtual walls rather than outsourcing. To crack down on cybercrime, the US Department of the Treasury's Office of Foreign Assets Control warned of sanctions for organizations facilitating ransom payment. Next, we predict sanctions against institutions and nations that don't combat cybercrime coming from their territory. More financial cybersecurity predictions for 2021 Crime gangs collaborating on advanced threats Advanced persistent threats (APTs) are the most dangerous kind of attacks, often seen in geopolitical clashes, intent on harming national interests. With the trend towards improved organization security and more people working from home, crime groups will exploit network technologies such as virtual private networks (VPNs,) using social engineering to get access. 5G is big news, with bogus stories of health risks and some nations limiting or banning Huawei products in their 5G infrastructure. Security researchers are examining Huawei and other 5G providers for implementation flaws. If found, they'll make the front pages. As more devices depend on 5G for connectivity, attackers will have more incentive to seek vulnerabilities to exploit. As ransomware becomes the weapon of choice for many criminals, we may see ransomware players' concentrate. In 2020 the Maze and Sodinokibi gangs pioneered an affiliate collaboration model. These bigger groups may combine to deliver APT-style attacks that overwhelm a target organization's system, to access specific data. We'll likely see attacks like these disrupt everyday lives. It could be an intentional attack on critical infrastructure like utilities or collateral damage from ransomware targeting big organizations we all rely on, like supermarkets, mail or public transport. More advanced threat predictions for 2021 Threats may be increasing, but fortunately, there's better education, technology and intelligence available today to help your organization stay secure and face the future.
threat attribution

How to find out who’s behind a cyberattack

  • min read
    • Knowing who or what has attacked us is critical for survival. In cybersecurity, threat intelligence cuts through the noise to find the poisoned needle in your data stack, letting you act fast before damage spreads. But what if you could also find out who is behind the attack? How threat attribution helps if you've been targeted by an APT If you've been targeted by an advanced persistent threat (APT), threat attribution helps you understand the attack motive and respond quickly. The cybercrime groups that carry out APT attacks are often linked to state-sponsored attacks. It's a costly way to get to their prize. If you have something they want, you could be a target. They're advanced. No low-cost software bought on the dark web by do-it-yourself cybercriminals. They build their own sophisticated software for purposeful damage. They're persistent. They seek you as their target, hitting you with weeks or months of attacks until they break through your IT security defenses. Or they lie dormant for years until the time to attack. Once in, they conduct secret operations to find critical data. If they're determined, there's only so much that cybersecurity software can keep safe. And they're a serious threat. Their goals range from espionage to sabotage, to data theft for profit. Threat attribution wins the threat intelligence race, but it's not for everyone Threat attribution is a next-level solution, but it's not for every business. It's like choosing a car. What you need depends on your journey. A budget motor is fine for driving from A to B. In cybersecurity, that's endpoint security. If you're carrying precious cargo, a limousine may be a worthwhile investment. In cybersecurity, that's threat intelligence. If you hold classified information that's interesting to a rival state, you're at greatest risk of an APT attack. National security and law enforcement agencies (like Interpol or the FBI) are most vulnerable. They have much to gain by uncovering who's hacking them. Sometimes APT attacks also target corporates, other government agencies and critical infrastructure like power plants and manufacturing. You don't have to be a big organization to be a target. If you're making components for a military plane, a less friendly state may want to know how you're making the rudder for counter-intelligence. Supply chain attacks are also on the rise. By hitting a laptop manufacturer, hackers can infect everyone in an organization. Then, when the time's right, they strike, cherry-picking who they spy on by hacking straight into their laptop. Who are the threat actors? APTs are a fast-growing 'industry.' These threat actors are not amateurs. They're super-organized crime workers. Some have different units for espionage, counter-intelligence and financial exploitation. Lazarus was the most significant threat actor in 2019. They attacked Sony Pictures Entertainment with a data-wipe in 2014 and made several attacks on South Korea. APT trends in 2020 predict more sophisticated attacks using artificial intelligence (AI) and deep fakes to access personal data. How does threat attribution work? When one of the most damaging ever ransomware attacks WannaCry hit in 2017, a Google researcher tweeted cryptic code showing similarities between WannaCry and 2015 malware attributed to Lazarus. This is threat attribution. You need to analyze and find clues that take you back to existing knowledge. By analyzing the attack's context, and nuances and languages deep in the code, researchers can reveal the threat actor's origins. These actors rarely leave a calling card, but they do leave evidence. We can analyze malware samples never seen before to find out if the actor is new, or an existing player in disguise. Like all forensic analysis, it's slow and painstaking. With highly sophisticated threats, it means reverse-engineering the attacks. It can take years, even for teams of the most skilled researchers. That's often enough time for attackers to achieve their goals. How can we shorten the analysis time? What if we could speed up the process? Faster attribution can shorten incident response times from hours to minutes, and reduce false positives. Kaspersky's Global Research and Analysis Team (GReAT) tracks over 600 APT actors and campaigns. To help the Information Security (InfoSec) community block APTs, they produce 120 or more subscriber reports each year and share highlights in quarterly APT trends reports. Profiling each threat actor can take years, building a database of everything you need to know about them. From this insight, Kaspersky developed one of the first solutions for automated threat attribution. It's like the Shazam app – that can identify the song you're humming by finding a match – for threat intelligence. By uploading a code sample to Kaspersky's Threat Attribution Engine, it matches previous attacks and APT groups in seconds. It analyzes the malware's 'genetics' to compare to 'genotypes:' known malware linked to a threat actor. This fast analysis can help those facing APT attacks to limit damage. We can't stop the flood of threats permeating our world, but we can build our defenses. Threat attribution is a new weapon in the arsenal for tackling organized cybercrime, and it could make it far harder for them to succeed.
threat intelligence

How threat intelligence evolved, and where it will go next

  • min read
    • Cybersecurity has always been about the intelligence that powers the tools. It's this intelligence that battles the minds that make malware. The epicenter of the battle is identifying and analyzing threats, or threat intelligence. What makes it threat intelligence, rather than threat data, is analysis. To understand why threat intelligence will be so crucial in cybersecurity's future, we need to visit the museum of its evolution. More innocent times: The noughties Mulholland Drive was in cinemas; Shaggy and Destiny's Child sold CDs by the bucket. Email was standard for business, but less so for personal use. Anyone geeky enough to 'surf the net' for fun might visit an internet café to use a coveted, futurist desktop iMac. A revolution in attractive hardware, it looked like the candy-colored offspring of motorcycle helmet and refrigerator produce compartment. The precursors to threat intelligence started appearing at this time. First, there were IP and URL blacklists. Security software like Security Information and Event Management (SIEM) systems, and next-generation firewalls (NGFWs) used the blacklists to give alerts and reports. Security researchers manually searched for threats and sent daily updates to customers. The bright, new digital past: 2010 It was the year Iceland's Mount Eyjafjallajökull grounded flights across Europe with a cloud of ash. Everyone was talking about Wikileaks and the Arab spring. Facebook and Twitter had become household names, but were far less used by marketers and brands. The dark web and malign activities were exploding, showing the limits of the day's security software. It wasn't designed to process the number of Indicators of Compromise pelting down like a deluge of frogs. They couldn't identify and process the dust storms of malicious domains, IPs and other threats. The cybersecurity industry responded. Machine learning and artificial intelligence (AI) could automate and correlate data on a new scale. With millions of sensors, their data feeds netted oceans of information. They processed and analyzed it with big data tools. These systems began to be used to perform complex detection covering all attack surfaces. And the big data technology gave birth to the idea of threat intelligence. Machine meets human: 2015 It was the year of Je Suis Charlie, as many sided with French satirists against terrorism. 195 countries reached agreement over the Paris Climate Accord, but the color of a dress divided the world firmly into two camps. Security experts overseeing intelligence collection could reduce false positives and better see threats and attack methods specific to their organizations. It meant faster detection and response, and a change of emphasis to finding and prioritizing vulnerabilities. The world we now know From 2018, the threat intelligence industry ballooned. Hundreds of new companies popped up, offering targeted services focused on data quality. Their goal was to give guidelines for decisions and actions. The companies buying threat intelligence products and services started using them more effectively, for example, adapting their data collection for security needs. By 2019 the industry had adopted a shared understanding of what threat intelligence means. Bear with me – this chain has a few links. Threat intelligence means multiple sources giving relevant, targeted data. The data must be converted into information that can be immediately used. It must be integrated into an organization's security operations through a single entry point, and communicate seamlessly with their existing security controls. Its unique insights on emerging threats will let security teams prioritize alerts, maximize resources and make fast decisions. And what of 2020 onwards? The market is still growing. Research suggests threat intelligence could be worth 13 billion US dollars by 2023. Ever smaller organizations are starting to use threat intelligence. But in the main, this will be a new era of cooperation. To be more comprehensive, cybersecurity vendors are already integrating their products and services with others. Cybersecurity will move from reactive to proactive, while the role of security teams in organizations will grow. They'll interact more at all levels and with all business groups. They'll become responsible for delivering proactive threat intelligence that not only protects, but identifies risk and shapes business goals. Threat intelligence will effectively predict and prevent attacks at the earliest stage, and sooner or later, underpin the whole concept of proactive cybersecurity and organizational risk. This article was published in April, 2020.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries