IBM Security has released its annual X-Force Threat Intelligence Index that found the Asia-Pacific region retained the top spot as the most attacked region in 2022 for the second consecutive year, accounting for 31 per cent of all incidents remediated worldwide.
According to the 2023 report, last year the deployment of backdoors, which allow remote access to systems, emerged as the top action by attackers (31 per cent of cases) followed by ransomware (13 per cent of cases). The majority of the backdoor attempts observed globally were failed ransomware attempts, where defenders were able to detect the backdoor before ransomware was deployed. The uptick in backdoor deployments can be partially attributed to their high market value. X-Force observed threat actors selling existing backdoor access for as much as $10,000, compared to stolen credit card data, which can sell for less than $10 today.
Commenting on the report, Charles Henderson, head, IBM Security X-Force, said, “The shift towards detection and response has allowed defenders to disrupt adversaries earlier in the attack chain – tempering ransomware’s progression in the short term. But it is only a matter of time before today’s backdoor problem becomes tomorrow’s ransomware crisis. Attackers always find new ways to evade detection. Good defence is no longer enough. To break free from the never-ending rat race with attackers, businesses must drive a proactive, threat-driven security strategy.”
Meanwhile, Viswanath Ramaswamy, vice president, Technology, IBM India and South Asia, said, “Businesses in Asia-Pacific including India will continue to face growing number and sophistication of cyber threats as bad actors take advantage of economic and geopolitical disruptions. Hence, it is imperative that business leaders take immediate action to prepare and secure against these malicious threats. This includes a holistic approach of understanding and reducing their attack surfaces, preparing for the specific threat actors and techniques that target their industry or geography, and performing regular offensive testing to detect attack paths into their environments.”
The IBM Security X-Force Threat Intelligence Index tracks new and existing trends and attack patterns – pulling from billions of datapoints from network and endpoint devices, incident response engagements and other sources.
Some of the key global findings in the 2023 report include:
- Extortion: Threat actors go-to method. The most common impact from cyberattacks in 2022 was extortion, which was primarily achieved through ransomware or business email compromise attacks.
- Cybercriminals weaponise e-mail conversations. Thread hijacking saw a significant rise in 2022, with attackers using compromised email accounts to reply within ongoing conversations posing as the original participant. X-Force observed the rate of monthly attempts increase by 100 per cent compared to 2021 data.
- Legacy exploits still doing the job. The proportion of known exploits relative to vulnerabilities declined 10 percentage points from 2018 to 2022, due to the fact that the number of vulnerabilities hit another record high in 2022. The findings indicate that legacy exploits enabled older malware infections such as WannaCry and Conficker to continue to exist and spread.
Cybercriminals often target the most vulnerable industries, businesses, and regions with extortion schemes, applying high psychological pressure to force victims to pay. Manufacturing was the most extorted industry in 2022, and it was the most attacked industry for the second consecutive year. Manufacturing organisations are an attractive target for extortion, given their extremely low tolerance for down time.
Ransomware is a well-known method of extortion, but threat actors are always exploring new ways to extort victims. One of the latest tactics involves making stolen data more accessible to downstream victims. By bringing customers and business partners into the mix, operators increase pressure on the breached organisation. Threat actors will continue experimenting with downstream victim notifications to increase the potential costs and psychological impact of an intrusion – making it critical that businesses have a customised incident response plan that also considers the impact of an attack on downstream victims.
Email thread hijacking activity surged last year, with monthly attempts by threat actors doubling compared to 2021 data. Over the year, X-Force found that attackers used this tactic to deliver Emotet, Qakbot, and IcedID, malicious software that often results in ransomware infections.
With phishing being the leading cause of cyberattacks last year, and thread hijacking’s sharp rise, it’s clear that attackers are exploiting the trust placed in email. Businesses should make employees aware of thread hijacking to help reduce the risk of them falling victim.
The ratio of known exploits to vulnerabilities has been declining over the last few years, down 10 percentage points since 2018. Cybercriminals already have access to more than 78,000 known exploits, making it easier to exploit older, unpatched vulnerabilities. Even after five years, vulnerabilities leading to WannaCry infections remain a significant threat. X-Force recently reported an 800 per cent increase in WannaCry ransomware traffic within MSS telemetry data since April 2022. The continued use of older exploits highlights the need for organisations to refine and mature vulnerability management programs, including better understanding their attack surface and risk-based prioritisation of patches.
The report features data IBM collected globally in 2022 to deliver insightful information about the global threat landscape and inform the security community about the threats most relevant to their organisations.