According to a new report from cybersecurity solutions firm Palo Alto Networks, the heavy use of software vulnerabilities matches the opportunistic behavior of threat actors who scour the internet for vulnerabilities and weak points on which to focus.
The 2022 Unit 42 Incident Response Report leveraged a sampling of over 600 Unit 42 IR cases, to help chief information security officers (CISOs) and security teams understand the greatest security risks they face, and where to prioritize resources to reduce them.
“As cybercriminals find more ways to exploit these software vulnerabilities, organizations must take the necessary steps to minimize the risks for the company and its stakeholders,” said Oscar Visaya, country manager for the Philippines at Palo Alto Networks. “Organizations must ramp up patch management and orchestration to try to close these known holes as soon as possible.”
Ransomware and business email compromise (BEC) were the top incident types that the Incident Response (IR) team responded to over the past 12 months. Palo Alto Networks quotes the findings of research company Statista, which reflect local data in which phishing emerged as the most frequent fraud scheme targeting consumers in the Philippines in the first quarter of 2021 (Q1 2022).
A new ransomware victim is posted on leak sites every four hours. Identifying ransomware activity early is critical for organizations. Typically, ransomware actors are only discovered after files are encrypted, and the victim organization receives a ransom note. Unit 42 has identified that the median dwell time — meaning the time threat actors spend in a targeted environment before being detected — observed for ransomware attacks was 28 days.
Ransom demands have been as high as $30 million, and actual payouts have been as high as $8 million, a steady increase compared to the findings of the 2022 Unit 42 Ransomware Report. Increasingly, affected organizations can also expect threat actors to use double extortion, threatening to publicly release sensitive information if a ransom isn’t paid. In the same report, the Philippines was also discovered as a key target for BlackCat Ransomware which emerged in late 2021.
Cybercriminals used a variety of techniques in business email compromise wire-fraud schemes. Forms of social engineerings, such as phishing, offer an easy and cost-effective way to gain covert access while maintaining a low risk of discovery. According to the Unit 42 report, in many cases, cybercriminals are simply asking their unwitting targets to hand over their credentials — and getting them. Once they have access, the median dwell time for BEC attacks was 38 days, and the average amount stolen was $286,000.
“Right now, cybercrime is an easy business to get into because of its low cost and often high returns,” said Wendi Whitmore, SVP and head of Unit 42 at Palo Alto Networks. “As such, unskilled, novice threat actors can get started with access to tools like hacking-as-a-service becoming more popular and available on the dark web. Ransomware attackers are also becoming more organized with their customer service and satisfaction surveys as they engage with cybercriminals and the victimized organizations.”
Palo Alto Networks customers can take advantage of Cortex Xpanse for attack surface management to identify vulnerable internet-exposed systems and can often catch systems that organizations may not be aware are running on the network. Customers also receive protections against the specific vulnerabilities discussed in this post through Cortex XDR, Prisma Cloud, Cloud-Delivered Security Services, and other products.