Cybersecurity threat landscape growing in sophistication, complexity and impact
The 9th edition of the ENISA Threat Landscape (ETL) report released by the European Union Agency for Cybersecurity highlights the surge in cybercriminality motivated by monetization using ransomware or cryptojacking. It covers a period of reporting starting from April 2020 up to July 2021.
Cybersecurity threats are on the rise. Ransomware ranks as a prime threat for the reporting period. For each of the identified threats, attack techniques, notable incidents and trends are identified alongside recommendations. The report also features a list of trends concerning threat actors.
EU Agency for Cybersecurity Executive Director, Juhan Lepassaar stated that “Given the prominence of ransomware, having the right threat intelligence at hand will help the whole cybersecurity community to develop the techniques needed to best prevent and respond to such type of attacks. Such an approach can only rally around the necessity now emphasized by the European Council conclusions to reinforce the fight against cybercrime and ransomware more specifically.”
The cybersecurity threat landscape is growing in terms of sophistication of attacks, complexity and impact. Such a trend is spurred by an ever-growing online presence, the transitioning of traditional infrastructures to online solutions, advanced interconnectivity and the exploitation of new features of emerging technologies.
Without surprise, supply-chains attacks rank highly among prime threats because of the significant potential they have in inducing catastrophic cascading effects. The risk is such that ENISA recently produced a dedicated threat landscape report for this specific category of threat.
The 9 top threats
9 threat groups were identified due to their prominent materialization over the reporting period.
- Ransomware
- Malware
- Cryptojacking
- E-mail related threats
- Threats against data
- Threats against availability and integrity
- Disinformation – misinformation
- Non-malicious threats
- Supply-chain attacks
Key trends
The COVID-19 crisis has created possibilities for adversaries who used the pandemic as a dominant lure in campaigns for email attacks for instance. Monetization appears to be the main driver of such activities.
The techniques that threat actors are resorting to are numerous. The non-exhaustive list below presents some of the most prevalent ones identified in the report, across all threats:
- Ransomware as a Service (RaaS)-type business models
- Multiple extortion ransomware schemes
- Business Email Compromise (BEC)
- Phishing-as-a-service (PhaaS)
- Disinformation-as-a-Service (DaaS) business model, etc.
Focus on three threats
Ransomware
Ransomware is a type of malicious attack where attackers encrypt an organization’s data and demand payment to restore access. Ransomware has been the prime threat during the reporting period, with several high profile and highly publicised incidents. The significance and impact of the threat of ransomware is also evidenced by a series of related policy initiatives in the European Union (EU) and worldwide.
Compromise through phishing e-mails and brute-forcing on Remote Desktop Protocol (RDP) services remain the two most common infection vectors. The occurrence of triple extortion schemes also increased strongly during 2021 and cryptocurrency remains the most common pay-out method for threat actors.
Cryptojacking infections
Cryptojacking or hidden cryptomining is a type of cybercrime where a criminal secretly uses a victim’s computing power to generate cryptocurrency. With the proliferation of cryptocurrencies and their ever-increasing uptake by the wider public, an increase in corresponding cybersecurity incidents has been observed. Cryptocurrency remains the most common pay-out method for threat actors.
Misinformation and disinformation
This type of threats makes its first appearance in the ENISA threat landscape report.
Disinformation and misinformation campaigns are on the rise as a result of the increased online presence due to the COVID-19 pandemic logically leading to an overuse of social media platforms and online media.
Such threats are of paramount importance in the cyber world. Disinformation and misinformation campaigns are frequently used in hybrid attacks to foster doubt or create confusion, therefore reducing the overall perception of trust as a consequence and damaging this major proponent of cybersecurity in the process.
Threat actors: Who are they?
Cyber threat actors are an integral component of the threat landscape. They are entities aiming to carry out a malicious act by taking advantage of existing vulnerabilities, with the intent to do harm to their victims. Understanding how threat actors think and act, what their motivations and goals are, is an important step towards a stronger cyber incident response.
Monitoring the latest developments with respect to the tactics and techniques used by threat actors to achieve their objectives is crucial for an efficient defence in today’s cybersecurity ecosystem. Such threat assessment allows us to prioritise security controls and devise an adequate strategy based on the potential impact and likelihood of threat materialization.