Business Economy News Security Society Technology Technology Trends Telecoms

Sophos 2023 Threat Report: Criminals “Follow the Money” by Commercializing Cybercrime, Launching More “Innovative” Ransomware Attacks and Doubling Down on Credential Theft

Sophos, a global leader in innovating and delivering cybersecurity as a service, today published its 2023 Threat Report. The report details how the cyberthreat landscape has reached a new level of commercialization and convenience for would-be attackers, with nearly all barriers to entry for committing cybercrime removed through the expansion of cybercrime-as-a-service. The report also addresses how ransomware remains one of the greatest cybercrime threats to organizations with operators innovating their extortion tactics, as well as how demand for stolen credentials continues to grow.

Criminal underground marketplaces like Genesis have long made it possible to buy malware and malware deployment services (“malware-as-a-service”), as well as to sell stolen credentials and other data in bulk. Over the last decade, with the increasing popularity of ransomware, an entire “ransomware-as-a-service” economy sprung up. Now, in 2022, this “as-a-service” model has expanded, and nearly every aspect of the cybercrime toolkit—from initial infection to ways to avoid detection—is available for purchase.

“This isn’t just the usual fare, such as malware, scamming and phishing kits for sale,” said Sean Gallagher, principal threat researcher, Sophos. “Higher rung cybercriminals are now selling tools and capabilities that once were solely in the hands of some of the most sophisticated attackers as services to other actors. For example, this past year, we saw advertisements for OPSEC-as-a-service where the sellers offered to help attackers hide Cobalt Strike infections, and we saw scanning-a-service, which gives buyers access to legitimate commercial tools like Metasploit, so that they can find and then exploit vulnerabilities. The commoditization of nearly every component of cybercrime is impacting the threat landscape and opening up opportunities for any type of attacker with any type of skill level.”

 

With the expansion of the “as-a-service” economy, underground cybercriminal marketplaces are also becoming increasingly commodified and are operating like mainstream businesses. Cybercrime sellers are not just advertising their services but are also listing job offers to recruit attackers with distinct skills. Some marketplaces now have dedicated help-wanted pages and recruiting staff, while job seekers are posting summaries of their skills and qualifications.

 

“Early ransomware operators were rather limited in how much they could do because their operations were centralized; group members were carrying out every aspect of an attack. But as ransomware became hugely profitable, they looked for ways to scale their productions. So, they began outsourcing parts of their operations, creating an entire infrastructure to support ransomware. Now, other cybercriminals have taken a cue from the success of this infrastructure and are following suit,” said Gallagher.

 

Indeed, as the cybercrime infrastructure has expanded, ransomware has remained highly popular—and highly profitable. Over the past year, ransomware operators have worked on expanding their potential attack service by targeting platforms other than Windows while also adopting new languages like Rust and Go to avoid detection. Some groups, most notably Lockbit 3.0, have been diversifying their operations and creating more “innovative” ways to extort victims.

 

“When we talk about the growing sophistication of the criminal underground, this extends to the world of ransomware. For example, Lockbit 3.0 is now offering bug bounty programs for its malware and ‘crowd-sourcing’ ideas to improve its operations from the criminal community. Other groups have moved to a ‘subscription model’ for access to their leak data and others are auctioning it off. Ransomware has become, first and foremost, a business,” said Gallagher.

 

The evolving economics of the underground has not only incentivized the growth of ransomware and the “as-a-service” industry, but also increased the demand for credential theft. With the expansion of web services, various types of credentials, especially cookies, can be used in numerous ways to gain a deeper foothold in networks, even bypassing MFA. Credential theft also remains one of the easiest ways for novice criminals to gain access to underground marketplaces and begin their “career.”

 

Sophos also analyzed the following trends:

 

  • The war in Ukraine had global repercussions for the cyberthreat landscape. Immediately following the invasion, there was an explosion of financially motivated scams, while nationalism led to a shake-up of criminal alliances between Ukrainians and Russians, particularly among ransomware affiliates.

 

  • Criminals continue to exploit legitimate executables and utilize “living off the land binaries” (LOLBins) to launch various types of attacks, including ransomware. In some cases, attackers deploy legitimate but vulnerable system drivers in “bring your own driver” attacks to attempt to shut down endpoint detection and response products to evade detection.

 

  • Mobile devices are now at the center of new types of cybercrimes. Not only are attackers still using fake applications to deliver malware injectors, spyware and banking-associated malware, but newer forms of cyberfraud have been growing in popularity, such as “pig butchering” schemes. And this crime is no longer just affecting Android users, but iOS users as well.

 

  • The devaluation of Monero, one of the most popular cryptocurrencies for cryptominers, led to a decrease in one of the oldest and most popular types of cryptocrime—cryptomining. But mining malware continues to spread through automated “bots” on both Windows and Linux systems.

 

To learn more about the changing threat landscape in 2022 and what it means for security teams in 2023, read the full Sophos 2023 Threat Report.

 

The Sophos 2023 Threat Report consists of research and insights from Sophos X-Ops, a new, cross-operational unit that links three established teams of cybersecurity experts at Sophos (SophosLabs, Sophos SecOps, and Sophos AI). Sophos X-Ops includes more than 500 cybersecurity experts worldwide uniquely equipped to offer a complete, multi-disciplinary picture of an increasingly complex threat landscape. To learn more about daily cyberattacks and TTPs, follow Sophos X-Ops on Twitter and subscribe to receive current threat research and security operations articles and reports from the frontlines of cybersecurity.

Leave a Comment

Your email address will not be published.

You may also like

Business Economy News

Zoracom® Marks a Decade of Innovation and Excellence in Nigeria’s IT Sector

post-image

 

Zoracom®, a leading technology solution company specializing in cybersecurity, celebrates its milestone tenth anniversary with pride and gratitude. Since its inception, Zoracom® has been at the forefront of empowering businesses with seamless solutions, driving operational efficiency, and ensuring end-to-end visibility.

From its humble beginnings as a startup offering IT services, Zoracom® has evolved into a dominant force in Nigeria’s IT landscape. Renowned for its expertise in business automation and cybersecurity, Zoracom® has continually raised the bar in delivering cutting-edge solutions tailored to the needs of its clients.

Reflecting on this remarkable journey, Kesiena Ogheneruru, Chief Operations/People Officer at Zoracom®, emphasized the company’s steadfast commitment to innovation in Nigeria’s IT industry. Ogheneruru stated, “Zoracom® has been leading the charge in business process automation and cybersecurity solutions, consistently pushing boundaries and driving positive change in the ecosystem.”Zoracom

At the core of Zoracom®’s operations lie infrastructure management, observability,…

Read More
Announcements Business Economy Government

Dr. Bosun Tijani joins Ethnos Cyber for High Impact cybersecurity Erudition Series

post-image

Dr. Bosun Tijani, renowned for his contributions in the field of cybersecurity, is set to join forces with Ethnos and OneIdentity/Quest for the launch of the Ethnos Cybersecurity Erudition Series. This groundbreaking initiative aims to bolster Cybersecurity awareness and expertise among key stakeholders in Abuja, particularly within the public sector.

In an age where digital governance is becoming increasingly prevalent, cybersecurity emerges as a critical concern for governments worldwide, including Nigeria. The integration of modern technologies has undoubtedly improved efficiency in governmental operations, but it has also introduced new vulnerabilities such as Identity Theft and Phishing. Hence, there is an urgent need for comprehensive Cybersecurity education and readiness.

The Ethnos Cybersecurity Erudition Series seeks to address these pressing issues by providing a platform for security experts and public-sector stakeholders to engage in informative discussions and knowledge sharing. With the theme “Navigating Cybersecurity Risks: Strategies for Securing Your…

Read More
Business Economy Investments News Opinion Society

Moppet Foods’ Founder, Roberta Edu, Aims for Global Excellence in Baby Food Manufacturing

post-image

In a remarkable pursuit of manufacturing excellence, Roberta Edu, the visionary IT expert and co-founder of MOPPET, a rapidly growing baby food brand, expressed her commitment to adhering to global best practices. From packaging to meal quality, Edu’s goal is to establish MOPPET as a benchmark in the competitive baby food industry.

“When I decided to become a manufacturer, my aim was clear: to provide the very best for Nigerian children and eventually export globally,” stated Roberta Edu. Not seeking to emulate existing products in Nigeria, she emphasized her focus on surpassing global standards in the baby food category.

Edu recounted her determination to attain the highest quality, even rejecting a machine made in Nigeria for not meeting her stringent standards. Turning to China for a solution, she shared her relentless pursuit of excellence, including a noteworthy incident with an Indian machinery store in Oregun.

Undeterred by…

Read More
Art Business Culture

Award-winning Director Biodun Stephen takes the reins for “Aso Ebi Diaries” produced by Lady Laide Films in Lagos, Nigeria

post-image

 

Lady Laide Films is thrilled to announce the commencement of shooting for its latest project, “Aso Ebi Diaries,” in the vibrant city of Lagos, Nigeria. With leadership from renowned director Biodun Stephen, whose creative talents have earned global recognition, the film promises to captivate audiences with its compelling narrative and stellar cast.

Production responsibilities are shared by Laide Daramola and Taiwo “Bossteewo” Adebayo. Laide Daramola is currently riding the success of her debut feature film “Hotel Labamba” which catapulted to success upon its release on Prime Video. The film’s quality was merited by its #1 ranking on the platform in Nigeria for eight consecutive days and currently holds a top 10 position in nine other countries. A household name in film and television production, Taiwo Adebayo’s slate of films boasts a gross budget of N26.8 billion. Such numbers have made her one of the highest indigenous-grossing producers of all time,…

Read More
Business News

NDPC Strengthens Sectorial Regulation, Signs MoU with NLRC and SMEDAN

post-image

 

The Nigeria Data Protection Commission (NDPC) signed two significant Memoranda of Understanding with the National Lottery Regulatory Commission (NLRC) and the Small and Medium Enterprises Development Agency of Nigeria (SMEDAN), aimed at bolstering data protection initiatives across various sectors.

The National Commissioner/CEO of NDPC, Dr Vincent Olatunji, represented NDPC, Director General, NLRC, Mr Lanre Gbajabiamila, represented NLRC, and DG of SMEDAN, Mr Charles Odii, represented SMEDAN during the signing of the MOU at the Headquarters of SMEDAN and NLRC respectively.

The partnership with SMEDAN seeks to promote data protection within the Small and Medium Enterprise ecosystem, with approximately 40 million SMEs.

The MoU establishes a framework for collaboration, including the formation of a working group to focus on capacity building in data protection. This initiative aims to educate SMEs on adopting appropriate technical and organizational measures towards safeguarding data privacy.

Dr Olatunji who expressed optimism about the implementation of the memoranda with the…

Read More
Art Business Economy

Unlocking the future of Journalism: Anambra ICT Agency, Activ8 Hub Empower Media Professionals on AI

post-image

 

In line with its vision aimed at digitally revolutionizing the media landscape, the Anambra State ICT Agency, in collaboration with Activ8 Hub, on Thursday, hosted an enriching workshop on Artificial Intelligence in Journalism for media professionals.

Th workshop took the practitioners through emerging AI models, such as ChatGPT, Gemini, Bing AI, Microsoft Copilot, among others, with the aim to enhance their journalistic practices, ensure more efficient, accurate, and compelling reportage.

The workshop facilitated by experts including Mr. Chukwuma Mezie-Okoye, co-founder of Activ8 Hub, and Nehemiah Onyekachukwu Emmanuel, an AI Engineer with Microsoft, offered deep insight into the transformative impact of AI in journalism. With a focus on leveraging AI to bolster productivity, fact-checking, and narrative crafting, the session illuminated the path for journalists to integrate these cutting-edge tools into their work responsibly.

The event also marked a significant stride in Anambra’s technological advancement, as was highlighted by Chukwuemeka Fred Agbata, CFA, the…

Read More
Business Culture Economy Government Opinion Society

Nigeria Commemorates International Women’s Day 2024

post-image

Today, Nigeria joins the global community in celebrating International Women’s Day, recognizing the remarkable progress and contributions of women worldwide.

This year’s theme, “Celebrating International Women’s Day!” underscores the importance of acknowledging the strength, resilience, and achievements of women in various spheres of life.

From influential leaders to nurturing mothers, women continue to shape our societies, driving positive change and inspiring future generations. International Women’s Day serves as a poignant reminder of the ongoing journey towards gender equality and empowerment.

While celebrating the milestones achieved, it is crucial to recognize the persistent challenges that women face and reaffirm our commitment to creating a more inclusive and equitable world. Empowering women to reach their full potential is not only a moral imperative but also essential for sustainable development and progress.

As…

Read More
Business Economy Gadgets Government International

Tanta Innovative Guides Nigerian Businesses Through Cross-Border Data Transfer Complexities

post-image

 

 

In today’s digitally interconnected world, individuals and organizations often find themselves managing data across international borders, a practice known as Cross-Border Data Transfer. As Nigerian businesses expand globally, navigating the legal and regulatory landscape surrounding data protection becomes paramount.

Tanta Innovative limited, an indigenous cybersecurity firm specializing in data advisory and solutions for Nigerian businesses, is at the forefront of addressing these challenges. Led by Founder and CEO, Abraham Tanta, the company offers valuable insights and solutions to mitigate the risks associated with cross-border data transfers.

Cross-border data transfer presents significant challenges, including potential breaches and legal implications,” stated Abraham Tanta. “At Tanta Innovative, we provide Nigerian businesses with free advisory services and deploy various solutions to preemptively address data breaches.”

Tanta elaborated on the complexities of cross-border data transfer, emphasizing the importance of compliance with regulations such as the Nigerian Data Protection Regulation (NDPR). He…

Read More