CS Jan-Feb 2024

attack… attack
Amit Sinha, DigiCert: post quantum
cryptography (PQC) is a seismic event
that will require IT leaders to begin
preparation now.
François Normand, head of cyber threat
intelligence at Gatewatcher: passwordless
alternatives should be developed as part
of an 'Identity Intelligence' strategy.
(605), EMEA (428) and Asia-Pacific (393) that
are knowledgeable about their organisations'
approach to PQC. Key findings from the
study, sponsored by DigiCert, include:
61% of respondents say their
organisations are not and will not
be prepared to address the security
implications of PQC
Almost half of respondents (49%) say
their organisations' leadership is only
somewhat aware (26%) or not aware
(23%) about the security implications
of quantum computing
Only 30% of respondents say their
organisations are allocating budget
for PQC readiness
525 of those surveyed say their
organisations are currently taking an
inventory of the types of cryptography
keys used and their characteristics.
FALSE DELIVERY
Equally concerning is a complex new attack
tactic that combines credible phone and
email communications, in an attempt to take
control of corporate networks and exfiltrate
data. During an investigation at a Swiss
company, Sophos X-Ops discovered that the
attack had begun with a telephone call that
may have seemed harmless. The targeted
employee was contacted directly by a man
who told the employee he had an urgent
delivery to make to one of the company's
sites and asked if the employee would accept
the delivery. To validate the new delivery -
allegedly for security reasons - the employee
had to read out a code sent by email during
the call.
The email, which was reported to have been
written in perfect French, contained no text
in the body of the message and featured
only a static image that appeared to be a
PDF attachment. Directed by the scammer
on the phone, the employee clicked on the
image, which then led to the malware being
downloaded. After verbally prompting the
employee to open the file, the attackers
began taking over the network.
"This attack was highly, highly targeted,"
says Andrew Brandt, principal researcher at
Sophos. "There was only one person in the
office that Friday and the attackers likely
knew who it was. The use of an image
masquerading as an email is also something
we haven't seen before. However, it's smart.
Attaching an actual PDF often triggers alarm
on systems, since they are so frequently used
to deliver malware, and emails with PDFs
often end up in spam filters."
NASTIEST MALWARE NAMED
Finally, OpenText has announced the Nastiest
Malware of 2023, an annual ranking of the
year's biggest malware threats. For six
consecutive years, OpenText Cybersecurity
threat intelligence experts have analysed the
threat landscape to determine the most
notorious malware trends. Ransomware
has been rapidly ascending the ranks, with
ransomware-as-a-service (RaaS) now the
weapon of choice for cybercriminals.
This year, four new ransomware gangs,
believed to be the next generation of previous
big players, topped the list. Newcomer Cl0p
took the prize for 2023's nastiest malware
after commanding exorbitant ransom
demands with its MOVEit campaign. Cl0p's
efforts helped skyrocket the average ransom
payment, which is rapidly approaching three
quarters of a million dollars, according to
OpenText. Black Cat, Akira, Royal and Black
Basta also made their debuts, joined by the
always-present Lockbit.
"A key finding this year is the RaaS business
model is another win for the bad guys," says
Muhi Majzoub, EVP and chief product officer,
OpenText. "Profit sharing and risk mitigation
are top contributors to RaaS success, along
with the ability to easily evade authorities.
There is a silver lining, as research shows
only 29% of businesses pay ransom, an alltime
low. These numbers indicate people are
taking threats seriously and investing in security
to be in a position where they do not need
to pay ransom," he concludes.
30
computing security Jan/Feb 2024 @CSMagAndAwards www.computingsecurity.co.uk