{"id":3273,"date":"2024-04-25T16:25:56","date_gmt":"2024-04-25T21:25:56","guid":{"rendered":"https:\/\/www.darkreading.com\/threat-intelligence\/5-attack-trends-organizations-of-all-sizes-should-be-monitoring"},"modified":"2024-04-25T16:25:56","modified_gmt":"2024-04-25T21:25:56","slug":"5-attack-trends-organizations-of-all-sizes-should-be-monitoring","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/04\/25\/5-attack-trends-organizations-of-all-sizes-should-be-monitoring\/","title":{"rendered":"5 Attack Trends Organizations of All Sizes Should Be Monitoring"},"content":{"rendered":"
<\/a><\/div>\n
<\/div>\n

Cybersecurity is constantly evolving and, as such, requires regular vigilance.<\/span><\/p>\n

Microsoft analyzes more than 78 trillion security signals every day to better understand the latest attack vectors and techniques. Since last year, we noticed a shift in how threat actors are <\/span>scaling and leveraging nation-state support<\/a><\/span>. It’s clear that organizations continue to experience more attacks than ever before, and attack chains are growing more complex. Dwell times have shortened and tactics, techniques, and procedures (TTPs) have evolved to become nimbler and more evasive in nature. <\/span><\/p>\n

Informed by these insights, here are five attack trends end-user organizations should be monitoring regularly.<\/span><\/p>\n

Achieving Stealth By Avoiding Custom Tools and Malware<\/h2>\n

Some threat actor groups are prioritizing stealth by leveraging tools and processes that already exist on their victims’ devices. This allows adversaries to slip under the radar and go undetected by obscuring their actions alongside other threat actors that are using similar methods to launch attacks. <\/span><\/p>\n

An example of this trend can be seen with <\/span>Volt Typhoon<\/a><\/span>, a Chinese state-sponsored actor that made headlines for targeting US critical infrastructure with living-off-the-land techniques.<\/span><\/p>\n

Combining Cyber and Influence Operations for Greater Impact<\/h2>\n

Nation-state actors have also created a new category of tactics that combines cyber operations and influence operations (IO) methods. Known as “cyber-enabled influence operations,” this hybrid combines cyber methods \u2014 such as data theft, defacement, distributed denial-of-service, and ransomware \u2014 with influence methods \u2014 like data leaks, sockpuppets, victim impersonation, misleading social media posts, and malicious SMS\/email communication \u2014 to boost, exaggerate, or compensate for shortcomings in adversaries’ network access or cyberattack capabilities. <\/span><\/p>\n

For example, Microsoft has observed multiple Iranian actors attempting to use <\/span>bulk SMS messaging<\/a><\/span> to enhance the amplification and psychological effects of their cyber-influence operations. We’re also seeing more cyber-enabled influence operations attempt to impersonate purported victim organizations or leading figures in those organizations to add credibility to the effects of the cyberattack or compromise.<\/span><\/p>\n

Creating Covert Networks By Targeting SOHO Network Edge Devices<\/h2>\n

Particularly relevant for distributed or remote employees is the rising abuse of small-office\/home-office (SOHO) network edge devices. More and more, we’re seeing threat actors use target SOHO devices \u2014 such as the router in a local coffee shop \u2014 to assemble covert networks. Some adversaries will even use programs to locate vulnerable endpoints around the world and identify jumping-off points for their next attack. This technique complicates attribution, making attacks appear from virtually anywhere.<\/span><\/p>\n

Rapidly Adopting Publicly Disclosed POCs for Initial Access and Persistence <\/h2>\n

Microsoft has increasingly observed certain nation-state subgroups adopting publicly disclosed proof-of-concept (POC) code shortly after it is released to exploit vulnerabilities in Internet-facing applications.<\/span><\/p>\n

This trend can be seen in threat groups like <\/span>Mint Sandstorm<\/a><\/span>, an Iranian nation-state actor that rapidly weaponized N-day vulnerabilities in common enterprise applications and conducted highly targeted phishing campaigns to quickly and successfully access environments of interest.<\/span><\/p>\n

Prioritizing Specialization Within the Ransomware Economy<\/h2>\n

We’ve been observing a continued move toward <\/span>ransomware specialization<\/a><\/span>. Rather than carry out an end-to-end ransomware operation, threat actors are choosing to focus on a small range of capabilities and services. <\/span><\/p>\n

This <\/span>specialization<\/a><\/span> has a splintering effect, spreading components of a ransomware attack across multiple providers in a complex underground economy. No longer can companies think of ransomware attacks as just coming from an individual threat actor or group. Instead, they may be combating the entire ransomware-as-a-service economy. In response, Microsoft Threat Intelligence now tracks ransomware providers individually, noting which groups traffic in initial access and which offer other services.<\/span><\/p>\n

As cyber defenders look for more effective ways to harden their security posture, it’s important to reference and learn from significant trends and breaches in years past. By analyzing these incidents and understanding different adversaries’ motives and favored TTPs, we can better prevent similar breaches from happening in the future.<\/span><\/p>\n

\u2014 Read more <\/span>Partner Perspectives from Microsoft Security<\/a><\/span><\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Cybersecurity is constantly evolving and, as such, requires regular vigilance.<\/p>\n","protected":false},"author":12,"featured_media":3274,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[809],"class_list":["post-3273","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-dark-reading"],"featured_image_urls":{"full":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/04\/5-attack-trends-organizations-of-all-sizes-should-be-monitoring.jpg?fit=1200%2C887&ssl=1",1200,887,false],"thumbnail":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/04\/5-attack-trends-organizations-of-all-sizes-should-be-monitoring.jpg?resize=150%2C150&ssl=1",150,150,true],"medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/04\/5-attack-trends-organizations-of-all-sizes-should-be-monitoring.jpg?fit=300%2C222&ssl=1",300,222,true],"medium_large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/04\/5-attack-trends-organizations-of-all-sizes-should-be-monitoring.jpg?fit=640%2C473&ssl=1",640,473,true],"large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/04\/5-attack-trends-organizations-of-all-sizes-should-be-monitoring.jpg?fit=640%2C473&ssl=1",640,473,true],"1536x1536":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/04\/5-attack-trends-organizations-of-all-sizes-should-be-monitoring.jpg?fit=1200%2C887&ssl=1",1200,887,true],"2048x2048":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/04\/5-attack-trends-organizations-of-all-sizes-should-be-monitoring.jpg?fit=1200%2C887&ssl=1",1200,887,true],"chromenews-featured":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/04\/5-attack-trends-organizations-of-all-sizes-should-be-monitoring.jpg?fit=1024%2C757&ssl=1",1024,757,true],"chromenews-large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/04\/5-attack-trends-organizations-of-all-sizes-should-be-monitoring.jpg?resize=825%2C575&ssl=1",825,575,true],"chromenews-medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/04\/5-attack-trends-organizations-of-all-sizes-should-be-monitoring.jpg?resize=590%2C410&ssl=1",590,410,true]},"author_info":{"display_name":"Dark Reading","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/darkreading\/"},"category_info":"Uncategorized<\/a>","tag_info":"Uncategorized","comment_count":"0","jetpack_featured_media_url":"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/04\/5-attack-trends-organizations-of-all-sizes-should-be-monitoring.jpg?fit=1200%2C887&ssl=1","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/3273","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=3273"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/3273\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media\/3274"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=3273"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=3273"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=3273"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}