Attacks against governments jumped 95% in last half of 2022

The number of attacks targeting the government sector increased by 95 per cent in the second half of 2022, a new report has found.

The report by AI-based cyber security vendor CloudSek found India, the US, Indonesia, and China accounted for 40 per cent of the total reported cyber security incidents in the government sector.

Rapid digitisation and the shift to remote work during the pandemic broadened the attack surface of government entities leading to an increase in attacks worldwide.

Government agencies are at a higher risk because of the huge amounts of individual data they collect and store. During an attack this information can be accessed and later sold on the dark web.

The most common types of attacks included hacktivist activity – hacking for political purposes – accounting for about nine per cent of the reported incidents in the government sector. Along with ransomware groups, which accounted for six per cent of the total incidents reported.

CloudSek noted to prevent future attacks a zero-trust model needs to be adopted by government agencies, assuming that the user identities or the network itself may already be compromised, proactively verifying the authenticity of user activity.

The report also found the most common threat actors of 2022 were KelvinSecurity and AgainstTheWest, the two groups were also most prominent in 2021.

KelvinSecurity uses targeted fuzzing and exploits common vulnerabilities to target victims. The group publicly shares information such as new exploits, targets, and databases on cybercrime forums.

AgainstTheWest started operations in October 2021 and identifies itself as APT49 or BlueHornet. It is focused on exfiltrating region-specific data and selling it on the dark web.

Do you know your Cyber Security capabilities, and your level of risk? Do you have a clear plan on how to improve your capabilities? Would you know what do to do if you had a cyber security incident? 

If you are concerned about cyber threats and don’t understand what your level of risk is, request a free assessment to start your journey on protecting your company, employees and customers below. 

Contact

Hackers abuse legitimate remote monitoring and management tools in attacks

Researchers and government agencies warn that threat actors are increasing their use of legitimate remote monitoring and management (RMM) tools to enable financial scams.

Researchers from Cisco Talos reported this week that one particular commercial RMM tool called Syncro was observed in a third of the incident response cases the company was engaged in during the fourth quarter of 2022.

RMM tools are commonly used by managed service providers (MSPs) and IT help desks so their presence on an organisation’s network and systems might not raise suspicion.

In a number of the attacks discovered, threat actors sent help-desk-themed phishing emails to employees on both their government-issued and personal email addresses.

The email link led to a website that prompted an executable download. If run, this file connected to a second domain controlled by the attackers and downloaded RMM tools such as ScreenConnect (now ConnectWise Control) and AnyDesk in self-contained portable executable format.

Malicious operators then instructed victims through the RMM software to open their bank account in the browser and used their access to modify the bank statement to show a larger-than-normal refund was issued to the victim’s account.

Cisco Talos reported nearly 40 per cent of engagements this quarter featured phishing emails used as a means to establish initial access, followed by user execution of a malicious document or link.

The lack of multi-factor authentication (MFA) remains one of the biggest weaknesses for enterprise networks. In almost 30 per cent of incidents investigated by Talos, MFA was either completely missing or was enabled only for a few critical services and accounts.

How secure is the RMM tool your company uses? Are you using MFA and passphrases to protect your accounts and devices? Would you be able to recognise a financial phishing attempt from a threat actor?

If you are concerned about the security of your RMM or need help understanding your level of risk, request a free assessment to start your journey on protecting your company, employees and customers below. 

Contact