Cybercrime poses a threat to every organisation. Industrial companies are no exception. They can expect this year to see, among other things, an increasing amount of spyware, malware that is constantly being targeted for detection and a smaller detectable footprint of cyber attacks.
This predicts cybersecurity firm Kaspersky. The company calls cyber attacks on industrial organisations "particularly dangerous" as cybercriminals can steal both data and money, as well as disrupt organisations' production system. Kaspersky warns of a growing interest from cybercriminals in industrial organisations. This is evidenced in part by an increase in the diversity of threats facing industrial networks. Adequately securing industrial networks is therefore becoming increasingly important.
More spyware
Russian-origin security company foresees several developments relevant to industrial organisations this year. Last year, for instance, the company already saw a new trend emerging in the criminal ecosystem. Attackers are using spyware to steal authentication data. In addition, the amount of spyware is on the rise. This form of malicious software is often deployed for the theft of money.
Kaspersky researchers also note that individual cyber attacks are increasingly focused on a very small number of targets. The attacks are thus more targeted than before. Such attacks are expected to make up a larger part of the threat landscape this year. Kaspersky also expects this modus operandi to spread to other types of threats.
Cybercriminals are adapting malware more frequently
Once malware is detected by security systems, in many cases the threat can be adequately mitigated. Cybercriminals capitalise on this by making detection as difficult as possible. In practice, this means that malware is regularly upgraded. Kaspersky reports that more and more cybercriminals are applying this strategy. They deploy malware at the peak of its effectiveness to break through the defences of security solutions. As soon as the current malware becomes easily detectable, they switch to a new version of the malware.
Kaspersky expects that this trend combined with the decreasing number of victims per individual cyber-attack is going to lead to an increase in the diversity of malware. This complicates detection and therefore presents challenges for security solution developers.
Detectable rogue footprint shrinks
Another measure cybercriminals are taking against detection, according to Kaspersky, is reducing the detectable footprint. This footprint consists of signals by which an imminent or ongoing cyber attack can be recognised. Cybercriminals reduce the footprint in particular by minimising the use of malicious infrastructure. Consider servers that have been used more frequently for attacks.
Kaspersky points out that in some cases, cybercriminals are also avoiding using untrusted and suspicious infrastructure. They then rely on trusted infrastructure. As an example, the security company cites phishing emails. Attackers increasingly spread these from a compromised corporate account. Attackers are also spending more time properly drafting phishing emails in the fight against automated detection.
Gain access to other organisations
The cybersecurity firm also specifically addresses Advanced Persistent Threats (APTs). APTs have a strategic, systematic approach that attackers use to maintain access to a target for as long as possible. This is in contrast to many cybercrimes. These are aimed at obtaining monetary gain, for example.
In APT incidents, attackers are increasingly trying to reach new targets via their victim. These include partners, the parent company or government agencies. In some cases, attackers hereby target data from these parties that the victim owns. In other cases, cybercriminals actually want to penetrate the network of these third parties.
About APTs, Kaspersky additionally reports that more and more focus is on 'Persistent', rather than 'Advanced'. In practice, this means that attackers are increasingly upgrading or extending their toolkit. In this way, they want to maintain access to their victims. Previously, attackers relied mainly on the tenacity and accuracy of the administrators of their toolkits. In doing so, they often used costly and complex frameworks to avoid detection for as long as possible. Kaspersky expects attackers to move away from this approach more often and choose to upgrade their toolkit.
Who is being targeted?
Popular targets for APTs, according to Kaspersky:
- Military-industrial and aviation sectors, focusing on military and technology espionage.
- Energy, transport and utilities companies. Attackers thus seek to gain a foothold in a potential adversary's critical infrastructure. They use this access to develop other attacks.
- Knowledge-based sectors, especially in view of industrial espionage.
Kaspersky expects cybercriminals to continue to target any target they can hit. In many cases, attackers hereby deploy well-known methods to monetise their attacks. Examples include:
- The direct theft of money by replacing bank data. Here, attackers often use Business Enterprise Compromise (BEC), also known as CEO fraud in the Netherlands. Here, attackers pose as a manager. They convince a legitimate employee to, for example, transfer a sum of money to a rogue bank account.
- Extortion or ransomware, in which attackers seek to trick victims into paying the ransom demanded.
- Reselling stolen information to other cybercriminals, competitors of the victim or other interested parties.
Kaspersky points out that traditional cybercrime causes greater financial damage from APTs in most cases. In 2021, for example, tens of millions of dollars were paid to cybercriminals deploying ransomware. Kaspersky knows of only one case where an APT led to significant financial damage. In this case, the attackers turned to extortion.
However, the security company does note that APTs have a delayed effect in some cases. Therefore, the fact that APTs did not cause major financial damage last year is no guarantee that this will be the case again this year.
Cyber hooligans and hacktivists
Kaspersky also warns against cyber hooligans and hacktivists. Attacks by these parties made global news several times in 2021. According to Kaspersky, these attacks demonstrate that vital industrial infrastructure is often poorly protected.
Further information and all of Kaspersky’s predictions for industrial companies are available here.
Author: Wouter Hoeffnagel
