Nowadays cyber threat actors use techniques to hide from detection and protection systems while causing harm to an organization. They use multiple techniques — comprising simple masquerading tactics or complex procedures of obfuscation and confusion — to mislead security solutions.
The present world's cyber threat actors are no longer concentrating on doing the maximum possible damage; they are trying their best to remain undetected. They have adopted new techniques including defense evasion, triple extortion, wiper malware, and supply chain attacks. Let's look at each of them in detail and see why they are so difficult to defend against — and what organizations can do to improve their odds.
Defense Evasion
The present-day cyber threat actors leave no stone unturned to keep their attacks as hidden as possible. One of the tactics they use to prevent getting caught is through a method called defense evasion. As per recent research, in 2020, defense evasion emerged as the most harmful security threat, registering over 57% of all IoC (Indicator of Compromise) alerts.
The rise of defense evasion among cyber threat actors is majorly because of better detection and protection technologies. The technologies are so rigid that threat actors are in a situation where they must find ways of overcoming security controls. Techniques employed for defense evasion comprise uninstalling or disabling security software, obfuscating or encrypting data and scripts, and deploying trusted processes to hide malware.
Triple Extortion Ransomware
Ransomware is not a new concept. However, the tactics, techniques, and procedures (TTPs) implemented by threat actors have become highly sophisticated over the past few years. With the rise in sophistication, there is the concern of safeguarding networks against expensive attacks such as triple extortion.
Traditionally, ransomware attacks comprised a single point: a victim encountered a ransom demand in return for the decryption key to unlock their systems and data. This scenario changed since 2019, when the capability emerged to lock down systems and exfiltrate data simultaneously — called double extortion. Developing on double extortion, cyber attackers added another layer: triple extortion means that ransom demands may also be targeted at a victim's clients or suppliers, compounding the pressure significantly.
Wiper Malware
The goal of wiper malware is to wipe the hard disk of the victim's system — its main purpose is to destroy data rather than to extract a ransom. The information is made permanently unavailable after erasing the data from any storage device. The major difference between wipers and ransomware is that it is impossible to retrieve the impacted information once a wiper attack happens.
Attackers deploying wipers do not generally look for financial reward but attempt to disrupt the victim's operations as much as possible. The wiping techniques engaged by the attacker include overwriting files, encrypting files, overwriting the Master Boot Record (MBR) of the disk, and overwriting the Master File Table (MFT).
Supply Chain Attack
A supply chain attack is a form of cyberattack where an organization is breached by means of vulnerabilities in its supply chain. These vulnerabilities are generally connected to vendors with poor security postures. Vendors need access to private data to connect with their users — hence if a vendor is breached, the user could also be considered to be breached thanks to the shared pool of data.
Supply chain attacks are particularly dangerous because they allow threat actors to leverage the trust relationship between organizations and their vendors to gain access to systems that might otherwise be well-defended.
Best Practices to Combat These Threats
Digital attack surfaces are quickly evolving with an increase in cyberattack attempts. Organizations should follow best practices to combat the above-mentioned threats:
- Keep patches up-to-date across all systems and software
- Use anti-ransomware tools with behavioral detection capabilities
- Secure privileged access management (PAM) solutions
- Execute a zero trust architecture — never trust, always verify
- Identify all potential insider threats through regular audits
- Minimize access to sensitive data on a need-to-know basis
- Monitor Indicators of Compromise (IoCs) associated with known attacks
- Assess supply chain vendors' security posture before granting access
- Maintain tested, off-site backups to counter both ransomware and wipers
Though threat actors are not only becoming more sophisticated but also rising in numbers, cloud-based security solutions including endpoint detection and response have made a great transformation with regard to fighting the odds. The key is that organizations must maintain up-to-date threat intelligence and build an effective cybersecurity strategy.