Navigating New Frontiers: Trend Micro 2021 Annual Cybersecurity Report

Recognizing employees’ increased dependence on email for communication, malicious actors took a renewed interest in phishing campaigns as an effective means of spreading malware such as Emotet. Malicious actors also took advantage of the abundance of information on the pandemic and vaccine development by using Covid-19 as an overarching theme for phishing emails. Phishing attempts that were detected and blocked by Trend Micro Cloud App Security, an API-based solution that protects both users and organizations from threats to their cloud-based apps and services, nearly doubled from those in 2020. Nearly two-thirds of these were spam emails, while the rest were credential-phishing attempts. (Credential phishing involves cybercriminals’ use of fake login pages to trick potential victims into handing over their account credentials, whereas phishing by spam emails is a broader category that aims to get user information.)

A comparison of the detections of spam phishing and credential-phishing attempts in 2021
Source: Trend Micro Cloud App Security

While phishing attempts increased, attempts at business email compromise (BEC) decreased. But we do not simply attribute this drop to a decline in cybercriminals’ interest or activity. Rather, it could be a result of the increased sophistication of BEC emails in evading antispam rules, with which we were able to keep pace: Trend Micro Cloud App Security detected and blocked a greater proportion of BEC attempts through authorship analysis — that is, by comparing the spoofing email with the writing style of the supposed sender —  in 2021 than in the previous year.

A comparison of the proportions of BEC attempts blocked based on authorship analysis (white) and BEC attempts blocked based on behavior and intention analysis (black) in 2020 and 2021
Source: Trend Micro Cloud App Security

Despite the availability of patches for them, many vulnerabilities that could be rightly described as old continued to dodge obsolescence. In the cybercriminal underground, demand persisted for exploits of legacy vulnerabilities, including those from as far back as 2005. Our 2021 study found that nearly a quarter of the exploits sold in the underground were of vulnerabilities that were at least three years old.

Unpatched security flaws led to some noteworthy incidents in 2021. One such flaw was Log4Shell (CVE-2021-44228), a high-severity vulnerability in Apache Log4j, a Java-based logging tool, that could allow attackers to send crafted log messages that execute arbitrary code. First reported privately to Apache in November, Log4Shell drew attention from the security and tech industries for the breadth of remediation that it warranted. Although the open-source Apache community had released a patch for it in December, it was still exploited in various illicit activities, including data theft, cryptocurrency mining, and ransomware attacks.

Vulnerabilities in Microsoft Exchange Server also made waves in 2021. Even though patches for them had been released, ProxyLogon (CVE-2021-26855) and ProxyShell (CVE-2021-34473 and CVE-2021-34523) were still abused for malicious activities. Most notably, they were used by the operators of the Squirrelwaffle loader to gain access to and hijack the email accounts of their victims.