Business Economy News Security Society Technology Technology Trends Telecoms

Sophos 2023 Threat Report: Criminals “Follow the Money” by Commercializing Cybercrime, Launching More “Innovative” Ransomware Attacks and Doubling Down on Credential Theft

Sophos, a global leader in innovating and delivering cybersecurity as a service, today published its 2023 Threat Report. The report details how the cyberthreat landscape has reached a new level of commercialization and convenience for would-be attackers, with nearly all barriers to entry for committing cybercrime removed through the expansion of cybercrime-as-a-service. The report also addresses how ransomware remains one of the greatest cybercrime threats to organizations with operators innovating their extortion tactics, as well as how demand for stolen credentials continues to grow.

Criminal underground marketplaces like Genesis have long made it possible to buy malware and malware deployment services (“malware-as-a-service”), as well as to sell stolen credentials and other data in bulk. Over the last decade, with the increasing popularity of ransomware, an entire “ransomware-as-a-service” economy sprung up. Now, in 2022, this “as-a-service” model has expanded, and nearly every aspect of the cybercrime toolkit—from initial infection to ways to avoid detection—is available for purchase.

“This isn’t just the usual fare, such as malware, scamming and phishing kits for sale,” said Sean Gallagher, principal threat researcher, Sophos. “Higher rung cybercriminals are now selling tools and capabilities that once were solely in the hands of some of the most sophisticated attackers as services to other actors. For example, this past year, we saw advertisements for OPSEC-as-a-service where the sellers offered to help attackers hide Cobalt Strike infections, and we saw scanning-a-service, which gives buyers access to legitimate commercial tools like Metasploit, so that they can find and then exploit vulnerabilities. The commoditization of nearly every component of cybercrime is impacting the threat landscape and opening up opportunities for any type of attacker with any type of skill level.”

 

With the expansion of the “as-a-service” economy, underground cybercriminal marketplaces are also becoming increasingly commodified and are operating like mainstream businesses. Cybercrime sellers are not just advertising their services but are also listing job offers to recruit attackers with distinct skills. Some marketplaces now have dedicated help-wanted pages and recruiting staff, while job seekers are posting summaries of their skills and qualifications.

 

“Early ransomware operators were rather limited in how much they could do because their operations were centralized; group members were carrying out every aspect of an attack. But as ransomware became hugely profitable, they looked for ways to scale their productions. So, they began outsourcing parts of their operations, creating an entire infrastructure to support ransomware. Now, other cybercriminals have taken a cue from the success of this infrastructure and are following suit,” said Gallagher.

 

Indeed, as the cybercrime infrastructure has expanded, ransomware has remained highly popular—and highly profitable. Over the past year, ransomware operators have worked on expanding their potential attack service by targeting platforms other than Windows while also adopting new languages like Rust and Go to avoid detection. Some groups, most notably Lockbit 3.0, have been diversifying their operations and creating more “innovative” ways to extort victims.

 

“When we talk about the growing sophistication of the criminal underground, this extends to the world of ransomware. For example, Lockbit 3.0 is now offering bug bounty programs for its malware and ‘crowd-sourcing’ ideas to improve its operations from the criminal community. Other groups have moved to a ‘subscription model’ for access to their leak data and others are auctioning it off. Ransomware has become, first and foremost, a business,” said Gallagher.

 

The evolving economics of the underground has not only incentivized the growth of ransomware and the “as-a-service” industry, but also increased the demand for credential theft. With the expansion of web services, various types of credentials, especially cookies, can be used in numerous ways to gain a deeper foothold in networks, even bypassing MFA. Credential theft also remains one of the easiest ways for novice criminals to gain access to underground marketplaces and begin their “career.”

 

Sophos also analyzed the following trends:

 

  • The war in Ukraine had global repercussions for the cyberthreat landscape. Immediately following the invasion, there was an explosion of financially motivated scams, while nationalism led to a shake-up of criminal alliances between Ukrainians and Russians, particularly among ransomware affiliates.

 

  • Criminals continue to exploit legitimate executables and utilize “living off the land binaries” (LOLBins) to launch various types of attacks, including ransomware. In some cases, attackers deploy legitimate but vulnerable system drivers in “bring your own driver” attacks to attempt to shut down endpoint detection and response products to evade detection.

 

  • Mobile devices are now at the center of new types of cybercrimes. Not only are attackers still using fake applications to deliver malware injectors, spyware and banking-associated malware, but newer forms of cyberfraud have been growing in popularity, such as “pig butchering” schemes. And this crime is no longer just affecting Android users, but iOS users as well.

 

  • The devaluation of Monero, one of the most popular cryptocurrencies for cryptominers, led to a decrease in one of the oldest and most popular types of cryptocrime—cryptomining. But mining malware continues to spread through automated “bots” on both Windows and Linux systems.

 

To learn more about the changing threat landscape in 2022 and what it means for security teams in 2023, read the full Sophos 2023 Threat Report.

 

The Sophos 2023 Threat Report consists of research and insights from Sophos X-Ops, a new, cross-operational unit that links three established teams of cybersecurity experts at Sophos (SophosLabs, Sophos SecOps, and Sophos AI). Sophos X-Ops includes more than 500 cybersecurity experts worldwide uniquely equipped to offer a complete, multi-disciplinary picture of an increasingly complex threat landscape. To learn more about daily cyberattacks and TTPs, follow Sophos X-Ops on Twitter and subscribe to receive current threat research and security operations articles and reports from the frontlines of cybersecurity.

Leave a Comment

Your email address will not be published.

You may also like

Agriculture Business Culture Economy

FG TO STREAMLINE EXISTING SORGHUM VARIETIES TO ENHANCE SELF-SUFFICIENCY, OTHERS

post-image

 

Federal Government has reiterated its commitment to streamline the existing sorghum varieties in the country to enhance Self-sufficiency, income generation, Food and Nutrition Security amongst others.

The Minister, Federal Ministry of Agriculture and Rural Development, Dr. Mohammad Mahmood Abubakar revealed this while receiving report of the Sorghum Technical Committee, in his office, in Abuja, recently.

He stated that the objective of streamlining the existing sorghum varieties was to find other ways of improving productivity, value addition and quality of sorghum produce, noting that the exercise was crucial as it would enhance farmer’s income, attract more youth to sorghum cultivation, meet national demand as well as contribute to the growth of the Gross Domestic Product.

In his words” This cannot be achieved without the collaborative efforts of all Stakeholders of which farmers, Seed producers, Input providers and international Institutes are part”.

He recalled that the technical committee arose from a sorghum stakeholders meeting on…

Read More
Business Economy

African startups are weathering the funding storm with acquisitions

post-image

A new report from Africa’s foremost digital economy consultancy, TechCabal (https://TechCabal.com) Insights has revealed that acquisitions have become more frequent in Africa’s tech ecosystem, showing signs of a maturing market. According to the report, 2021 saw 32 acquisition deals on the continent. At the end of Q3 2022, there were about 43 acquisition deals, signaling a consolidation trend.

 

 

After two years of continuous growth in VC investment, funding announcements have hit a plateau. Startups have resorted to cutting costs to extend their runway, and acquisition deals have become necessary for survival, particularly with startups operating in the same market. The number of acquisitions between startups operating in the same market increased from 31% in Q2 to 52% in Q3 2022.

 

The State of Tech in Africa Report compiled by TechCabal Insights, also found that the average seed ticket size remained stable at $2.5M in…

Read More
Business Economy Society Technology Technology Trends

Multimillion-dollar boost for small business as more African countries join MultiChoice Africa Accelerator Programme

post-image

Following the success of the MultiChoice (www.MultiChoice.com) Africa Accelerator (https://bit.ly/3OtthRz) Programme, which secured $16 million (USD) of funding for six emerging businesses last year, the programme has been expanded to eight more countries across Africa.

 

Many more small businesses in Africa’s technology sector now have the chance to benefit from the 2023 programme, which provides the skills and opportunities needed to attract transformative business funding.

“We’re really excited to be expanding the MultiChoice Africa Accelerator Programme to more African countries,” said Calvo Mawela, MultiChoice Group CEO, announcing the launch. “It’s part of our long-term commitment to growing and multiplying Africa’s technology potential, which is critical to our future growth.”

The MultiChoice Africa Accelerator Programme, which kicked off during Global Entrepreneurship Week,  is aimed at established start-ups and small enterprises in specific technology sectors – healthtech, agritech, fintech, edutech, the circular economy and the creative industries.

“There…

Read More
Announcements Business Culture Events Technology Tourism Trends

Spark Africa set to hold the largest tech gathering in Africa; the Africa Technology Expo.

post-image

 

Spark Africa, The African Technology Leader has announced the company’s readiness to host the African Technology Expo, a gathering of tech enthusiasts and stakeholders with the aim of promoting indigenous African talents and innovations.

This was disclosed by the Convener of the event and CEO of Spark Africa, Nnaemeka Clinton, during a Press briefing.

According to him;“Nigeria has over 30 Million People with viable ideas, about 10,000 startups and over 200 of these startups are fintech.

Most tech events in Africa and Nigeria specifically do not solve the issue of helping our unique talents with viable tech ideas translate their ideas to startups.
This isn’t about creating an avenue for motivation and encouraging networking amongst African talents alone, that is good, however, the “working the talk” is by transforming their ideas into startups.
The Africa Technology Expo, the largest tech gathering in Africa is different, this year’s debut edition is aimed at converting over…

Read More
Announcements Business Economy Technology Technology Trends Telecoms

ON THE UPCOMING AUCTION OF TWO (2) LOTS OF 3.5GHZ SPECTRUM

post-image

 

The Nigerian Communications Commission (the Commission), in line with Section 121 of the Nigerian Communications Act 2003 (the Act) has the responsibility to manage and administer Spectrum resources for the communications sector in an efficient and effective manner. This is for the socio-economic benefit of the country.

Accordingly, it is the Commission’s responsibility, as the industry regulator, to ensure that harmonized and standardized Spectrum resources are made available in a timely manner to ensure its optimal utilization. The impact of the Commission’s regulatory activities in this regard is evident in the contribution of ICT, and telecommunications in particular, to the Gross Domestic Product (GDP) of the country.

The Act allows available Spectrum resources to be licensed through different methods. Spectrum licensing via Auction is one of the most transparent methods of assigning Spectrum resources globally. It is important to note that the Commission in response to requests for more Spectrum lots…

Read More
Business Economy News Technology Technology Trends Telecoms

NCC-CSIRT Urges Adoption of Two-Factor Authentication as Somnia Ransomware Targets Telegram Accounts

post-image

 

In response to the discovery of a new attack that compromises victims’ VPN (Virtual Private Network) accounts to compromise messaging app, Telegram, the Nigerian Communications Commission’s Computer Security Incident Response Team (NCC-CSIRT) has advised users to adopt two-factor authentication to protect their Telegram accounts and to not download unknown Advanced IP Scanner Software.
Ukrainian cyber experts discovered the attack, which uses Vidar Malware (Vidar Stealer) to steal Telegram session data, which in the absence of configured two-factor authentication and a passcode, allows unauthorized access to the victim’s telegram account and corporate account or network.

The malware, which exploits unauthorized access to users’ Telegram accounts and corporate accounts to steal data, targets platforms across iOS, Android, Linux, Mac and Windows Operating Systems.

“The Ukrainian CERT alleged that a Somnia Ransomware was created to be used on Telegram that tricks users to download an installer that mimics ‘Advanced IP Scanner’ software, which contains Vidar…

Read More
Business Economy Energy

KOLMANI OIL AND GAS PROJECT HAS ATTRACTED OVER $3BN INVESTMENT IN FOSSIL ENERGY – PRESIDENT BUHARI

post-image

 

– Restates Net Zero Carbon Emission By 2060

President Muhammadu Buhari has declared that his administration attracted over $3bn investment in the Oil and Gas Sector at a time of near-zero appetite for investment in fossil energy.

Speaking Tuesday in Bauchi at the Flag-off Ceremony of the Kolmani Integrated Development Project, a fully integrated in-situ development project comprising upstream production, oil refining, power generation and fertilizer, President Buhari said:

“Considering the land locked location and the huge capital requirement, the economics of the project is a challenging proposition. Consequently, from the outset, I instructed NNPC Limited to utilize and leverage their vast asset portfolio across all corridors of its operations to de-risk the project to attract the much-needed investment.

“It is therefore to the credit of this administration that at a time when there is near zero appetite for investment in fossil energy, coupled with the location challenges, we are able to attract…

Read More
Business Culture Economy Technology Technology Trends

uqudo Paves The Way for Digital Identity in Africa

post-image

uqudo’s (https://uqudo.com/) CEO, Mohamed Fagiri recently spoke on “Building Global Bridges: How to Access New Markets” at the Africa Tech Festival, the leading tech festival connecting innovators and changemakers across the continent. Mohamed shared his insights on scaling start-ups and building key products that can transform the world.

 

 

A digital identity company that is building an “identity layer” that makes customer onboarding safe, efficient and cost-effective in a digital world, uqudo has seen major growth in the past few months. Providing digital identity verification for key fintech players in the EMEA region, uqudo has also partnered with numerous entities in the African region to enhance digital identity in the continent.

 

The World Bank and Africa Development bank estimate that of the 1.3 billion people in Africa, 50% are smartphone users. With the population projected to increase in the next few decades, smartphone penetration will also see drastic…

Read More