Connect with us

Hi, what are you looking for?

HEADLINES

Use of software vulnerabilities matches opportunistic behavior of threat actors – Palo Alto Networks

The 2022 Unit 42 Incident Response Report offers a multitude of insights gleaned from Unit 42 by Palo Alto Networks’ extensive incident response (IR) work, leveraging a sampling of over 600 Unit 42 IR cases, to help chief information security officers (CISOs) and security teams understand the greatest security risks they face, and where to prioritize resources to reduce them.

According to a new report from Palo Alto Networks, a global cybersecurity player, the heavy use of software vulnerabilities matches the opportunistic behavior of threat actors who scour the internet for vulnerabilities and weak points on which to focus. The 2022 Unit 42 Incident Response Report offers a multitude of insights gleaned from Unit 42 by Palo Alto Networks’ extensive incident response (IR) work, leveraging a sampling of over 600 Unit 42 IR cases, to help chief information security officers (CISOs) and security teams understand the greatest security risks they face, and where to prioritize resources to reduce them.

Oscar Visaya, Country Manager for the Philippines at Palo Alto Networks, shared, “As cybercriminals find more ways to exploit these software vulnerabilities, organizations must take the necessary steps to minimize the risks for the company and its stakeholders. Organizations must ramp up patch management and orchestration to try to close these known holes as soon as possible.”

Ransomware and business email compromise (BEC) were the top incident types that the Incident Response team responded to over the past 12 months, accounting for approximately 70% of incident response cases. The findings reflect local data of research company Statista in which phishing emerged as the most frequent fraud scheme targeting consumers in the Philippines in Q1 2022.

  • Ransomware

A new ransomware victim is posted on leak sites every four hours. Identifying ransomware activity early is critical for organizations. Typically, ransomware actors are only discovered after files are encrypted, and the victim organization receives a ransom note. Unit 42 has identified that the median dwell time — meaning the time threat actors spend in a targeted environment before being detected — observed for ransomware attacks was 28 days. Ransom demands have been as high as $30 million, and actual payouts have been as high as $8 million, a steady increase compared to the findings of the 2022 Unit 42 Ransomware Report. Increasingly, affected organizations can also expect threat actors to use double extortion, threatening to publicly release sensitive information if a ransom isn’t paid. In the same report, the Philippines was also discovered as a key target for BlackCat Ransomware which emerged in late 2021.

  • BEC

Cybercriminals used a variety of techniques in business email compromise wire-fraud schemes. Forms of social engineering, such as phishing, offer an easy and cost-effective way to gain covert access while maintaining a low risk of discovery. According to the report, in many cases, cybercriminals are simply asking their unwitting targets to hand over their credentials — and getting them. Once they have access, the median dwell time for BEC attacks was 38 days, and the average amount stolen was $286,000.

“Right now, cybercrime is an easy business to get into because of its low cost and often high returns. As such, unskilled, novice threat actors can get started with access to tools like hacking-as-a-service becoming more popular and available on the dark web,” said Wendi Whitmore, SVP and head of Unit 42 at Palo Alto Networks. “Ransomware attackers are also becoming more organized with their customer service and satisfaction surveys as they engage with cybercriminals and the victimized organizations”

Advertisement. Scroll to continue reading.

Palo Alto Networks customers can take advantage of Cortex Xpanse for attack surface management to identify vulnerable internet-exposed systems and can often catch systems that organizations may not be aware are running on the network. Customers also receive protections against the specific vulnerabilities discussed in this post through Cortex XDR, Prisma Cloud, Cloud-Delivered Security Services, and other products.

Advertisement
Advertisement
Advertisement

Like Us On Facebook

You May Also Like

HEADLINES

“Data is the new oil. In the wrong hands, they can be used to steal someone’s money or identity. That’s why when we let...

HEADLINES

Unisys, PSA's accredited partner, will provide digital government services and manage the end-to-end process of originating, authenticating, securing, and issuing civil registry documents to...

HEADLINES

Kaspersky Industrial OVAL Data Feed for Windows delivers comprehensive intelligence about vulnerabilities in most popular SCADA and distributed control systems (DCS) based on data...

BUSINESS

SMEs in India, Malaysia, Philippines, and Vietnam were among the most optimistic about their future e-commerce growth in the next three years, a sentiment...

MOBILE PRODUCTS

Gear up for the exclusive vouchers, cashback, freebies, bundles, and other exciting perks when you buy OPPO devices via its official stores on Shopee...

HEADLINES

Since January this year, thousands of batteries have been reported stolen from Smart cell sites, with more than 600 incidents logged nationwide.

HEADLINES

PLDT has been powering up ACC since 2004 which has attracted decision-makers as delegates from over 400 companies from 60+ countries.

HEADLINES

This October, the digital telco is relaunching the once go-to place for skaters and BMX bikers in Circuit Makati with a weekly live art...

Advertisement