FortiGuard Labs Reports Disruptive Shift of Cyber Threats

Fortinet,a global leader in broad, integrated, and automated cybersecurity solutions, today announced the findings of the latest semiannual FortiGuard Labs Global Threat Landscape Report. Threat intelligence from the second half of 2020 demonstrates an unprecedented cyber threat landscape where cyber adversaries maximized the constantly expanding attack surface to scale threat efforts around the world. Adversaries proved to be highly adaptable, creating waves of disruptive and sophisticated attacks. They targeted the abundance of remote workers or learners outside the traditional network, but also showed renewed agility in attempts to target digital supply chains and even the core network

Commenting on this report,Michael Joseph, Director System Engineering, India & SAARC, Fortinet said,“2020 witnessed a dramatic cyber threat landscape from beginning to end. Although the pandemic played a central role, as the year progressed cyber adversaries evolved attacks with increasingly disruptive outcomes. They maximized the expanded digital attack surface beyond the core network, to target remote work or learning, and the digital supply chain. Cybersecurity risk has never been greater as everything is interconnected in a larger digital environment. Integrated and AI-driven platform approaches, powered by actionable threat intelligence, are vital to defend across all edges and to identify and remediate threats organizations face today in real time.”

Highlights of the 2H 2020 report

• Onslaught of Ransomware Continues: FortiGuard Labs data shows a sevenfold increase in overall ransomware activity compared to 1H 2020, with multiple trends responsible for the increase in activity. The evolution of Ransomware-as-a-Service (RaaS), a focus on big ransoms for big targets, and the threat of disclosing stolen data if demands were not met combined to create conditions for this massive growth.

• Supply Chain Takes Center Stage: Supply chain attacks have a long history, but the SolarWinds breach raised the discussion to new heights. As the attack unfolded, a significant amount of information was shared by affected organizations.

• Adversaries Target Your Online Moves: Examining the most prevalent malware categories reveals the most popular techniques cybercriminals use to establish a foothold within organizations. The top attack target was Microsoft platforms, leveraging the documents most people use and consume during a typical workday. Web browsers continued to be another battlefront. This HTML category included malware-laden phishing sites and scripts that inject code or redirect users to malicious sites. These types of threats inevitably rise during times of global issues or periods of heavy online commerce.

• The Home Branch Office Remains a Target:The barriers between home and office eroded significantly in 2020, meaning that targeting the home puts adversaries one step closer to the corporate network. In the second half of 2020, exploits targeting Internet of Things (IoT) devices, such as those existing in many homes, were at the top of the list. Each IoT device introduces a new network “edge” that needs to be defended and requires security monitoring and enforcement at every device.

• Cast of Actors Joins Global Stage: Advanced Persistent Threat (APT) groups continue to exploit the COVID-19 pandemic in a variety of ways. The most common among them included attacks focused on gathering personal information in bulk, stealing intellectual property, and nabbing intelligence aligned with the APT group’s national priorities. As the end of 2020 neared, there was an increase in APT activity targeting organizations involved in COVID-19-related work including vaccine research and development of domestic or international healthcare policies around the pandemic.

• Flattening the Curve of Vulnerability Exploits: Patching and remediation are ongoing priorities for organizations as cyber adversaries continue to attempt to exploit vulnerabilities for their benefit. By tracking the progression of 1,500 exploits in the wild over the last two years, data demonstrates how fast and how far exploits propagate. Even though it is not always the case, it seems that most exploits do not seem to spread far very fast.

Fighting Cyber Adversaries Requires an Integrated Strategy and Broad Awareness

Organizations face a threat landscape with attacks on all fronts. Threat intelligence remains central to understanding these threats and how to defend against evolving threat vectors. Visibility is also critical, particularly when a significant amount of users are outside the typical network scenario. Every device creates a new network edge that must be monitored and secured. The use of artificial intelligence (AI) and automated threat detection can enable organizations to address attacks immediately, not later, and are necessary to mitigate attacks at speed and scale across all edges. Cybersecurity user awareness training should also remain a priority as cyber hygiene is not just the domain of IT and security teams. Everyone needs regular training and instruction on best practices to keep individual employees and the organization secure.