Palo Alto Networks’ Unit 42 recently released the Ransomware Retrospective 2024: Unit 42 Leak Site Analysis and Incident Response report 2024. As part of the Ransomware Retrospective, they studied 3,998 leak site posts from various ransomware groups. Leak sites are platforms where threat actors publicly disclose stolen data as a means of coercing victims into paying ransom.

Key findings from this investigation: Unit 42 saw a 49% YoY increase in multi-extortion ransomware attacks from 2022 – 2023 globally. In India, the manufacturing sector has been the most targeted industry for ransomware extortion in 2023. Of the 3,998 leak site posts from 2023 globally, LockBit ransomware remains the most active, with 928 organizations accounting for 23% of the total. LockBit is also the most active group in APAC and India (note: this was before the recent law enforcement disruption of LockBit). At least 25 new ransomware leak sites were observed in 2023; of which Akira led the way. 

Anil Valluri, MD and VP, India and SAARC, Palo Alto Networks, said, “In India, the Manufacturing sector has emerged as the primary target for ransomware attacks over the past year. This unsettling trend underscores the critical vulnerabilities within the Indian manufacturing sector, where limited visibility into operational technology (OT) systems, inadequate network monitoring, and suboptimal cyber-hygiene implementation have left organizations exposed. Organizations must implement enterprise-wide Zero Trust network architecture to create layers of security that limit an attacker from successfully moving laterally around the network.”

The 3,998 posts from ransomware leak sites represented a 49% increase compared to 2022, where 2,679 posts were observed globally. This increase can be attributed to zero-day exploits targeting vulnerabilities for MOVEit Transfer SQL Injection and GoAnywhere MFT, among others.

As further evidence, when reviewing the number of compromises reported by ransomware leak sites, sporadic spikes were observed (see figure below). These loosely aligned with periods where ransomware groups began exploiting specific vulnerabilities.

Unit 42 2024 Incident Response Report: Speed of Exfiltration + Vulnerabilities Driving Activity

Unit 42 analyzed more than 600 incidents from 250 organizations for the 2024 Unit 42 Incident Response Report. This investigation went beyond ransomware leaksite posts into the overall casework volume. While phishing has historically been a popular tactic with attackers, the report found that it is declining, but only sort of.

From a one-third share of initial access incidents in 2022, phishing has dropped to just 17% in 2023. This indicates a potential de-prioritization of phishing as cybercriminals adapt to more technologically advanced – and perhaps more efficient – infiltration methods. More advanced threat actors are moving away from traditional and interactive phishing campaigns to less noticeable and possibly automated methods of exploiting system weaknesses and pre-existing credential leaks. Other key findings from the report include:

●      More-Sophisticated Threat Actors Are Gaining Initial Access Differently: There has been a discernible rise in the exploitation of software and API vulnerabilities. Exploiting such vulnerabilities accounted for 38.60% of the initial access points in 2023, up from 28.20% in 2022.

• Threat Actors Grab Data Indiscriminately: In 93% of incidents, threat actors took data indiscriminately rather than searching for specific data. This is up from 2022, when 81% of cases involved non-targeted data theft. In 2021, it was even lower at 67%. The surge points to a growing trend among cybercriminals who seem to be casting a wider net, gathering any data they can access rather than expending effort to locate and extract particular datasets.
• Extortion tactics to maximize yields: Interestingly, while the rate of harassment and other extortion tactics w.r.t. Ransomware has remained steady over the past few years, the rate of harassment in cases where payments were made has jumped by 27x since 2021.
• Higher demands, lower payouts: In 2023, median ransom demands increased from $650,000 to $695,000 (3%↑) but median payouts decreased from $350,000 to $237,500 (32%↓). This can be potentially attributed to organizations calling-in Incident Response teams with negotiation capabilities (which fewer did in the past).

Huzefa Motiwala, Director, Systems Engineering, India and SAARC, said “While the surge in ransomware incidents is concerning, there are glimmers of hope amidst the challenges. The data reveals a promising shift in organizations’ response strategies, with a notable increase in median ransom demands countered by a decrease in median payouts. Since organizations are more willing to call-in Incident Response teams, threat actors are happy to take the path of least resistance. Which, in most scenarios, is to grab what they can get, and move on.”

The post Manufacturing the worst hit by ransomware in India: Palo Alto research appeared first on CIO Dimension.

2023 saw organisations witness unprecedented levels of cybercrime. Palo Alto Networks’ State of Cybersecurity survey found that 67% of Indian government/essential services witnessed more than 50% increase in disruptive cyberattacks in 2022–2023. In October 2023, the firm received the most number of calls to their incident response team ever. Cybercriminals have used ransomware to target critical infrastructures and found novel techniques to exploit emerging technologies like generative AI to ill-effect. 

The State of Cybersecurity survey also found that 75% of Indian organisations have increased their cybersecurity budgets in 2023 compared to 2022. With Indian organisations investing more within cybersecurity, it’s critical this money be spent wisely.

Predicting cybersecurity trends for 2024 will be especially important if organisations want to get ahead of modern cyberattackers. With stakes higher than ever, organisations need to take a holistic approach – accounting for macroeconomic factors, emerging technologies, and cloud risks among others.

Ian Lim, Field Chief Security Officer, Palo Alto Networks, said, “In 2023, we’ve seen mature organisations, who invest heavily in cybersecurity, still falling victim to debilitating cyberattacks. This is due to the tenacity and ingenuity of attackers who exploit cyber hygiene issues or find novel ways to compromise legacy defences. Another key reason for these breaches lies in the complexity of security capabilities in most modern organisations. They use an average of 31.58 disparate security tools to protect their highly interconnected and innovative environments. The lack of correlation and the level of noise generated by these tools creates immense visibility gaps and dampens their ability for detection and response.”

He added, “Going into 2024, highly motivated cybercriminals, nation state attackers and hacktivists will continue to innovate, expand and exploit – not much we can do to slow that down. However, we could and should definitely address the complexity of our security capabilities with AI to make them more effective and cost efficient.”

Here are the five cybersecurity trends to watch out for in 2024:

1.        Hacktivism: the modern crusade 

2023 saw numerous instances of broadcast events being disrupted by climate activists. This year, this protest could take the shape of a cyber-first campaign. With significant events like the Olympics, the Euros, and regional elections coming up, hacktivists will look to further their cause to audiences in the millions. Previously, a high level of technical expertise was necessary, but the cybercrime-as-a-service model has lowered this threshold. Now, it only takes an extremely motivated activist with sufficient funds.

Tumultuous geopolitical climates will provide opportunities for hacktivists to gain notoriety for their group and sympathy for their cause. Most hacktivist activity is via Distributed-Denial-of-Service (DDoS) attacks. For example, during the G20 Summit in India, more than 30 groups of hacktivists from neighbouring countries attacked more than 600 websites of government and private entities through DDoS attacks, defacements, and data leaks.

In 2024, organisations should evaluate their risk profile according to the evolving threat landscape and ensure coverage not only for financially motivated attacks but also for hacktivism and nation-state attacks.

2.        AI’s role in cybersecurity will evolve, for good and bad

Since ChatGPT’s launch in October 2022, there have been concerns worldwide regarding its potential to democratise cybercrime. Despite having guardrails to prevent malicious applications, a few creative prompts can get ChatGPT to generate near flawless phishing emails that sound “weirdly human” at immense scale. We’ve seen attackers use Gen AI in novel ways like deepfake and voice technology to scam banks out of millions. Companies adopting Gen AI must be wary about the vulnerabilities of model poisoning, data leakage, prompt injection attacks, etc. Attackers will continue to exploit innovation gaps with the increased use of Gen AI for legitimate use cases.

Hence, one of the AI Cybersecurity trends expected in 2024 is the maturation on how organisations protect enterprise-level use of Gen AI. This involves making sure that security controls, vulnerability management and threat monitoring activities are embedded through the entire lifecycle of AI development projects. Gen AI will further embed itself into cybersecurity capabilities. Its ability to summarise, weed through noise, and give concise summaries of security events is far greater than a human analyst’s (especially at the scale a modern SOC operates). With LLMs getting better by the day, we are bound to see more sophisticated applications that move beyond just being a clever and occasionally-hallucinating chatbot.

3.        Operational technology will remain the low-hanging fruit

Operational Technology is the heart of any industrial organisation. As the primary generator of revenue, OT systems must have a high level of cyber maturity. Palo Alto Networks’ State of Cybersecurity survey found that 67% of Indian government/essential services witnessed more than 50% increase in disruptive cyberattacks in 2022–2023. As organisations scramble to resolve OT-related cybersecurity woes, they will face a lack of specialised solutions that cater to the specific and niche needs of OT professionals. Many organisations still believe OT environments are protected by an air gap, whereas IT/OT convergence has resulted in OT being more connected than ever to IT and, in many cases, to the cloud. This has expanded the attack surface and greatly increased the risk to OT networks, without the investment in cyber controls.

A breach of OT systems can not only result in lost revenue, but also potentially, injuries or loss of life. A cyber secure OT environment is also a safe and reliable OT environment. A Zero Trust architecture will protect the most critical OT systems from threats, while allowing organisations to focus on their digital transformation. 2024 will see organisations invest in OT cyber security maturity to protect their most important business systems and manage the increased risk to an acceptable level.

4.        Consolidation to enable the next frontier in cybersecurity

Unit 42’s Cloud Threat Report (Volume 7) found that on average, security teams take approximately 6 days to resolve a security alert, with 60% of organisations taking longer than 4 days. In a threat landscape where attackers only require a few hours to find and exploit vulnerabilities, 4-6 days is just way too long. Organisations with disparate security tools that are not well integrated have a harder time deploying automation and orchestration. This is a major setback to reducing the mean time to detect and the mean time to respond. 

In addition to the lacklustre threat response, organisations with siloed solutions are having a hard time securing their rapid digital transformation initiatives. Alongside macroeconomic headwinds and workforce challenges, enterprises are looking to consolidate their vendor spread and reduce complexities. Put simply, it is easier to manage the cybersecurity stack if there is one point of contact when a crisis inevitably strikes. Over the long term, it reduces costs and yields better results. This is thanks to the increased visibility and seamless integration that comes with a unified security offering. More organisations are waking up to these benefits and thus 2024 will see customers focus on reducing complexities and turning to consolidated cybersecurity stacks. 

5.        Securing the cloud will be high on the agenda 

Per the State of Cybersecurity survey, India leads APAC in cloud migration, with 80% of businesses already having a large proportion of infrastructure on the cloud, and 42% adjusting their cybersecurity strategy to adopt cloud security. Early adopters of cloud typically start with a single hyperscaler. Naturally, the single cloud model would adopt native security tools from their chosen Cloud Service Provider (CSP). Through the course of time, they experience issues and outages that can only be addressed by adopting a multi or hybrid cloud strategy. This multicloud journey would most likely necessitate a review on their existing cloud security paradigm as native CSP security tools do not seamlessly translate to different CSPs. 

In 2024, organisations that have to contend with multi or hybrid cloud projects would move to establishing a more unified approach to security when dealing with more than one cloud provider. Rationalising cloud security tools across the entire development lifecycle will also be a focus as this provides much higher visibility, correlation, and security monitoring.

The post Hacktivism to GenAI: Here are the top 5 cybersecurity predictions for 2024 appeared first on CIO Dimension.

A Palo Alto survey findings revealed that, although India saw a remarkable 75% increase in cybersecurity budget allocation for 2023 compared to the previous year (one of the highest increases in the APAC region), it also experienced the highest number of disruptive cyber attacks.

Palo Alto Networks surveyed 200 Indian IT decision-makers, CTOs, CIOs, and Senior Directors to understand the state of cybersecurity in India. The respondents belonged to sectors such as Banking & Finance, Essential Services, Telco/Tech/Communications, Retail/Hotel/F&B, Transport & Logistics, and Manufacturing. 

India faces a substantial risk of cyber attacks targeting its critical infrastructure, public sector, and essential services, according to the findings. A notable 67% of Indian government and essential service entities reported encountering a surge of over 50% in disruptive attacks.

Key findings from the survey include:

Industries:

• 66% of Indian manufacturing firms faced increased risks from unsecured IoT devices connected to the network, far more than other sectors.
• 83% of Transport and Logistics organizations perceive their risk level as high or very high.
• An overwhelming 95% of businesses in India claim they are actively moving to an increasingly automated security stack.
• 48% of Indian Public, Transport & Logistics organizations and 50% of Manufacturing organizations sectors believe 5G adoption will widen security loopholes.
• A higher than average 34% of Indian banking and financial services say cloud attacks will disrupt business. 
• 69% of Indian Telcos have faced newfound risks from increased reliance on cloud-based services and apps.

Cybersecurity risks:

• 45% of Indian businesses saw more than 50% increase in disruptive attacks – the highest in APAC. 
• 67% of Indian government and essential services experienced more than 50% increase in disruptive attacks.
• At 35% Indian organizations are more concerned about social engineering attacks than the APAC average (29%). 
• 60% of Indian organizations are concerned about malware (ransomware, spyware, adware) attacks the most. 57% of Indian Telcos are concerned about Ransomware the most. 
• 94% of Indian organizations perform regular assessments and forensics for OT related cybersecurity incidents, this is positive news. Likely driven by the fact that 89% of these organizations have IT and OT cybersecurity professionals working under the same/ combined team, higher than the SEA average of 82%.
• On the other hand, 24% of these organizations have their OT systems connected with their Enterprise IT network (not fully air gapped or protected via a dematerialized zone); a definite cause of concern.

Security outlook:

• 68% of Indian respondents say ChatGPT will positively impact business tasks like content creation and report generation.
• India leads APAC in cloud migration, with 80% of businesses already having a large proportion of infrastructure on the cloud.
• Over 80% of Indian businesses discuss cybersecurity at the board level at least every quarter. 
• 42% of Indian organizations say they are adjusting their cybersecurity strategy to adopt cloud security. 
• 94% of Indian organizations said they have a 5G strategy in place. However, 45% of these organizations said that proper segmentation of 5G networks was of top concern to them (highest in APAC). 

“Securing essential services networks is crucial to protect critical infrastructure and ensure the uninterrupted delivery of essential services, safeguarding public safety and national stability. Our findings show that the transport, manufacturing, and public sectors have borne the brunt of advanced attacks. As India embraces digital transformation, it is mission critical to have a cybersecurity-first approach,” said Anil Valluri, Managing Director & Regional Vice President of India & SAARC, Palo Alto Networks.

The post Disruptive cyber attacks on the rise despite a big leap in cybersecurity budgets  appeared first on CIO Dimension.