News
Hacker teams offering ’Victims-as-a-Service’ will rise
November 2022 by Osirium Technologies plc
"For the last couple of years, threat actors have been team-based. Before cryptocurrency, they were lone wolves – or, occasionally, a loosely connected group who’d met online. Then they started working in teams, and because they were paid money those teams became tightly bonded. Over the next year we’ll see more teams divide out into skills-based groups.
"REvil demonstrated how successful the ransomware-as-a-service model could be, offering an end-to-end solution for attackers that included encryption software, access tools, helpdesks for victims, payment services and much more. But there’s still a market for smaller teams that focus on specific attack skills. For example, they may breach defences to acquire user or admin credentials, or even install malware to provide back door entry for use at a later date. They don’t have to take on the risk of executing the attack or handling payment; they can make good money just by selling the access on dark web marketplaces.
"Company intelligence may be another specialist service. For example, knowing what cyber insurance a potential victim has could reveal the kinds of defences they’ll have in place and even how much they’re insured for, so ransomware demands can be tailored. New details emerging around the MediBank breach story give an insight into just how much information and access is up for sale on the dark web.
"It will become more crucial than ever that organisations protect their endpoints to reduce the attack surface, and restrict access credentials – especially those that allow key changes to be made, or enable lateral movement across systems and networks – to only those individuals who need them and for only the time they’re needed."
Ransomware attacks will shift to smaller targets – and the education sector.
"Ransomware will always go where the maximum reward and minimum risk is. Attackers will target organisations that have the lowest defences, or the least resources to defend against or recover from an attack, as they’re most likely to pay. State actors will still go after large institutions like the NHS, which implement robust defences, but there are many small to mid-size companies that invest less in protection, have limited technical skills, and find cyber insurance expensive, all of which makes them easy targets.
"We can expect smaller scale attacks, for lower amounts of money, but which target a much broader base. The trend will probably hit education providers hard: education is already the sector most likely to be targeted by a malware, cryptojacking or encrypted attack, according to SonicWall’s 2022 Cyber Threat Report.
"For instance, every school in the UK is being asked to join a multi-academy trust, where groups of schools will be responsible for themselves. With that change comes great vulnerability. This ’network’ of schools would be a prime target for ransomware attacks; they are connected, and they’re unlikely to have the resilience or capabilities to protect against attacks. They may have no choice but to reallocate their limited funds to pay ransom demands which, in turn, will affect their teaching."
Attackers will refocus on ransomware as the Ukraine conflict winds down.
"The rate of growth in ransomware attacks is currently slowing slightly – but this will prove to be a false dawn. Currently, the most successful teams of cyber-criminals are being focused on attacking Ukraine’s critical infrastructure. The second that conflict is over, all the technology, tools and resources will be redeployed back into ransomware attacks – so organisations and nation states alike must not become complacent."
Cyber insurance will become a board-level issue.
"Cyber insurance will get more expensive, and more difficult to acquire, with increasingly heavy requirements on clients to take all necessary and reasonable precautions before they can buy it. Insurers are also less likely to pay out – and the more claims there are, the more they’ll push back.
"As a result, more organisations may decide not to take out insurance at all, instead focusing on ploughing resources into protection. If this happens, we can expect to see insurance companies partnering with big consulting firms to offer joined up services. Rule no.1, insurance always wins!
"Pointless it may be, if insurers are never going to pay out...but buying cyber insurance may simply become a necessary cost of doing business – a box that must be ticked to demonstrate to shareholders that all steps are being taken to protect the business, and ensure resilience and continuity.
"Proof that privileged access credentials are being protected is one of the requirements increasingly being demanded by cyber insurers. Organisations should invest in solutions that will manage these powerful accounts, without impeding the productivity of their employees."
