In this blog post
Top Cyber Threats that Rocked the World in 2021
A business cannot be completely resilient to cyberattacks simply because no cybersecurity defense is impenetrable. While it is imperative to have a cybersecurity strategy, that alone will no longer be sufficient for the evolving threats. Recent incidents and the large-scale disruptions illustrate the growing impact of cyber threat activity on enterprise risk across all industry segments. The growing sophistication of cyber threats can be attributed to evolving corporate IT infrastructure and the current COVID-19 pandemic. The growth of technologies is also introducing new vulnerabilities and risks. As a result, security leaders must understand the importance of creating a ‘preparation, prevention, and pre-encryption’ defense model.
Ransomware
In a ransomware attack, hackers target the cloud, managed service providers, industrial processes, and software supply chains to gain access. Once they gain entry, they encrypt the hacked data and demand payment to restore access to the organization. In 2021, cybersecurity authorities across the globe observed an increase in high-impact ransomware incidents against critical infrastructure organizations. The top three industries affected by ransomware in 2021 were government, banking, and healthcare. Fourteen incidents involving ransomware were observed in various essential sectors of the U.S., including food and agriculture, emergency services, IT, and defense industrial base. Some of the most significant ransomware attacks in 2021 include the colonial pipeline breach that had several impacts disrupting gas supply infrastructure along the East Coast of the United States. In May 2021, the hacker group DarkSide targeted a chemical distribution company Brenntag with a demand of USD 7.5 million in bitcoin.
Phishing
Phishing campaigns continue to be an effective means to spread malware. According to Trend Micro 2021 annual cybersecurity report, phishing emails were responsible for 90% of data breaches last year. In a phishing attack, hackers send emails by impersonating businesses or individuals, adding spoofed hyperlinks or websites, sharing malicious attachments. Broadly, hackers focus on two categories of phishing attacks: spam and credential phishing. While some email phishing attacks are direct, others are discreet. For example, in a whaling or spear attack, hackers have prior knowledge about the victim and try to lure them in with a request. Given that most organizations have started to educate employees, hackers have revisited their strategy and are using machine learning to trick employees into compromising sensitive business and personal information.
Malware
Hackers are various agents such as trojan malware, adware, viruses, spyware, ransomware, and worms used to gain access to a victim’s computer. According to Covid-19 cyberattack analysis by Cynet, malware attacks account for 35% of cyberattacks. Some of the most prominent malware include Shlayer, CoinMiner, Mirai, NanoCore, Quasar, ZeuS, Gh0st, BitCoin Miner, Ursnif, and CryptoWall. One of the reasons why hackers find it relatively easy to send malware to a system is that employees might not periodically run any antivirus or anti-malware scan. As a result, hackers can gain entry into the system by sending an infected link, downloadable attachment, or redirecting to a website with a malicious pop-up ad. In March 2021, CNA Financial Corp was attacked by malware, ‘Phoenix Locker,’ that affected the company’s private network.
Cyber-Physical attacks
A cyber-physical attack has a direct impact on the physical world. While cyber threats against cyber-physical systems have existed for decades, 2021 experienced an ever-increasing number of threats to cyber-physical systems. These cyber-physical attacks are evolving as infrastructure has become an easy target for cybercriminals. According to Gartner, the financial impact of CPS attacks resulting in fatal casualties will be over USD 50 billion by 2023. Another reason for the increase is the rise of the pandemic. Organizations are focused on sustaining their businesses rather than addressing security gaps. Some of the heavily targeted industries are critical infrastructure and healthcare. An example of a cyber-physical attack is the colonial pipeline breach that happened in 2021. This breach had several severe impacts, disrupting gas supply infrastructure along the East Coast of the United States.
IoT attacks
2021 witnessed a considerable spike in IoT cyberattacks. With IoMT on the rise, the healthcare industry has been one of the highly affected industries by the growing cyberattack trend. As new technologies such as AI and edge computing emerged, their growth has also threatened the cyber and data security landscape. To put things in perspective, statista.com claims that the number of connected IoT devices will reach 75 billion by 2025. While this could allow businesses to get better data and customers to enjoy the rewards of new technology, it also shows the associated vulnerabilities and risks. Some of the most common ways for hackers to attack IoT devices include weak passwords, old versions without routine firmware updates, and lack of security patch updates.
To effectively manage the risk of cyberattacks, organizations must implement defenses to prevent, detect, and respond to attacks. While CEOs must focus on enterprise-wide security measures to protect data and assets, they must also educate employees with simple security hygiene initiatives. Conduct classes to make employees aware of the need for regular software updates, teach methods to create new stronger passwords, implement two-factor authentication for better safety, and perform periodic backups of company data, among others. These are small measures that need to be put in place that will go a long way.
GAVS for Cybersecurity
GAVS delivers end-to-end cybersecurity Services, helping clients manage risk and build an effective cybersecurity program. GAVS caters to the full suite of organizational cybersecurity needs – assessment, operations, and/or strategy – and can help conquer your most critical cybersecurity issues. To learn more, please visit https://www.gavstech.com/service/security-services/.
References
https://www.cisa.gov/uscert/ncas/alerts/aa22-040a
https://illinois.touro.edu/news/the-10-biggest-ransomware-attacks-of-2021.php
https://documents.trendmicro.com/assets/rpt/rpt-navigating-new-frontiers-trend-micro-2021-annual-cybersecurity-report.pdf
https://www2.deloitte.com/ch/en/pages/risk/articles/impact-covid-cybersecurity.html
https://www.securitymagazine.com/articles/96146-5-cybersecurity-threats-for-businesses-in-2021and-3-tips-to-combat-them
https://www.cisecurity.org/insights/blog/top-10-malware-june-2021
https://www.securitymagazine.com/articles/96217-cyber-physical-security-in-an-interconnected-world
https://www.iotworldtoday.com/2021/09/17/iot-cyberattacks-escalate-in-2021-according-to-kaspersky/
https://www.gartner.com/en/newsroom/press-releases/2021-07-21-gartner-predicts-by-2025-cyber-attackers-will-have-we
https://finitestate.io/blog/top-12-iot-exploits-of-2021-p1
Author
