Stepping Ahead of Risk: Trend Micro 2023 Midyear Cybersecurity Threat Report

Ransomware groups continue to update their tools and techniques for expanded targets and efficient data extraction. Earlier this year, new player Mimic abused the legitimate search tool Everything to query file extensions and names to determine which files to encrypt and avoid. Meanwhile, the Royal ransomware has been expanding its targets with an update aiming at Linux platforms.

Our investigations of Royal and Mimic suggested connections with the larger and more notorious Conti ransomware group, while our investigation of TargetCompany showed its links to other families such as the BlueSky and the GlobeImposter ransomware. These connections are consistent with our ransomware revolution insight about how collaborations could lead to lower costs and increased market presence while also maintaining the efficacy of criminal activities.

Meanwhile, financial gain might not be the only motivator for ransomware groups, as government entities could offer recruitment opportunities to operators in lieu of prosecution. In our May report on the RomCom backdoor, we discussed how the historical use of the backdoor in geopolitically motivated attacks on Ukraine since at least October 2022 suggests a shift in Void Rabisu’s targets. Recent ransomware attacks are now comparable to APT groups in terms of skills, approach, and attack capabilities.

Ransomware players who remain in it for money might also turn their data exfiltration efforts toward cryptocurrency theft, business email compromise (BEC), and deploying short-and-distort schemes for stock market manipulation. Cryptocurrency has also made payment schemes more efficient in favor of threat actors, underlining the demand to shift left — meaning implementing as many measures as possible for blocking threats from entering the network in the first place — when anticipating ransomware-related attacks that trigger extortion only after gaining access and exfiltrating data.

The Cyber Risk Index (CRI) decreased to moderate range with a score of +0.01 in the second half of 2022, according to a survey of over 3,700 businesses across four regions. However, details of our report show that North America’s CRI is the most elevated among regions at -0.10, with its Cyber Preparedness Index worsening from 5.30 to 5.29 and its Cyber Threat Index dropping from 5.63 to 5.39. As for vulnerability advisories, 894 were published in the first half of 2023, only 50 fewer than those published in the first half of the previous year.

Meanwhile, threat actors are casting a wider net by leveraging vulnerabilities in smaller platforms for more specific targets, such as file transfer service MOVEit, business communications software 3CX, and print management software solution PaperCut. In June, the Clop ransomware leveraged a vulnerability in MOVEit and compromised various government agencies in the United States earlier this year, namely the Department of Energy, university systems in multiple states, and private businesses.

In May, Google launched eight new top-level domains (TLDs), including .zip and .mov. This can pose security risks when exploited by cybercriminals to hide malicious URLs behind legitimate websites for malware delivery and other attacks — a tried-and-tested technique that remains effective today.

While innovations continue to evolve and involve more data, threat actors are finding more ways to victimize people. For example, today’s connected cars contain over 100 million lines of code, giving smart functionality to the user but also opening doors to hackers. As more smart cars saturate the market, attackers will try to gain access to user account data and leverage it for crimes.

These threats underline the need for a proactive cyber risk management that operationalizes elements of a zero-trust strategy and continuous visibility and assessment across the entire risk life cycle that would comprise discovery, assessment, and mitigation. Investments in extended detection and response would result in sufficient data, analytics, and integrations from which security teams and researchers can reap insights into threat activity and how well defenses are coping.