Highlights of FortiGuard Labs H1 Global Threat Landscape Report

FortiGuard Labs reports tenfold increase in ransomware in June 2021 compared to a year ago

The report indicates an expanding attack surface of hybrid workers and learners, in and out of the traditional network, showing that timely collaboration and partnership momentum across law enforcement as well as public and private sectors is an opportunity to disrupt the cybercriminal ecosystem going into the second half of 2021.

One highlight of the H1/2021 report is that ransomware is about much more than just money. Accordingly, FortiGuard Labs data shows average weekly ransomware activity in June 2021 was more than tenfold higher than levels from one year ago.

This demonstrates a consistent and overall steady increase over a year period. Attacks crippled the supply chains of multiple organisations, in particular sectors of critical importance, and impacted daily life, productivity, and commerce more than ever before.

Organisations in the telecommunications sector were the most heavily targeted followed by government, managed security service providers, automotive, and manufacturing sectors. In addition, some ransomware operators shifted their strategy away from email-initiated payloads to focusing on gaining and selling initial access into corporate networks further showing the continued evolution of Ransomware-as-a-Service (RaaS) fueling cybercrime.

A key takeaway is that ransomware remains a clear and present danger for all organisations regardless of industry or size. Organisations need to take a proactive approach with real-time endpoint protection, detection, and automated response solutions to secure environments along with a zero-trust access approach, network segmentation, and encryption.

Ranking the prevalence of top malware detections by malware families shows a rise in deceptive social engineering malvertising and scareware. More than one in four organisations detected malvertising or scareware attempts with Cryxos being a notable family.

However, a large volume of the detections are likely combined with other similar JavaScript campaigns that would be considered malvertising. The hybrid work reality has undoubtedly encouraged this trend in tactics by cybercriminals as they attempt to exploit it, aiming for not just a scare but also extortion. Increased cybersecurity awareness is as important as ever to provide timely training and education to help avoid falling victim to scareware and malvertising tactics.

The report also reflects a surge in activity through the prevalence of botnet detections showed. At the beginning of the year, 35 per cent of organisations detected botnet activity of one sort or another, and six months later it reached 51 per cent. More than a year into remote work and learning shifts, cyber adversaries continue to target our evolving daily habits to exploit the opportunity. To protect networks and applications, organisations need zero-trust access approaches to provide least access privileges to secure against IoT endpoint and devices entering the network.

Studying higher resolution threat intelligence reveals valuable takeaways about how attack techniques are evolving currently. FortiGuard Labs analysed the specific functionality inherent to detected malware by detonating the samples to observe what the intended outcome was for cyber adversaries.

The result was a list of negative things malware would have accomplished if the attack payloads had been executed in target environments. This shows cyber adversaries sought to escalate privileges, evade defenses, move laterally across internal systems, and exfiltrate compromised data, among other techniques.

For example, 55 per cent of observed privilege escalation functionality leveraged hooking and 40 per cent utilised process injection. A takeaway is that there is an obvious focus on defense evasion and privilege escalation tactics.

Although these techniques are not novel, defenders will be better positioned to secure against future attacks, armed with this timely knowledge. Integrated and artificial intelligence (AI)-driven platform approaches, powered by actionable threat intelligence, are essential to defend across all edges and to identify and remediate shifting threats organisations face today in real time.

“We are seeing an increase in effective and destructive cyberattacks affecting thousands of organisations in a single incident creating an important inflection point for the war on cybercrime. Now more than ever, everyone has an important role in strengthening the kill chain,” said Derek Manky, chief at Security Insights and Global Threat Alliances, FortiGuard Labs.

“Aligning forces through collaboration must be prioritised to disrupt cybercriminal supply chains. Shared data and partnership can enable more effective responses and better predict future techniques to deter adversary efforts. Continued cybersecurity awareness training as well as AI-powered prevention, detection, and response technologies integrated across endpoints, networks, and the cloud remain vital to counter cyber adversaries,” he noted.

This latest Global Threat Landscape Report is a view representing the collective intelligence of FortiGuard Labs, drawn from Fortinet’s vast array of sensors collecting billions of threat events observed around the world during the first half of 2021.FortiGuard Labs Global Threat Landscape Report describes how threat actors find vulnerabilities, build malicious infrastructure, and exploit their targets.