Cybercriminals are increasingly working like businesses,
with different groups handling different parts in a single cyberattack, a new
report has revealed.
Latest findings by cybersecurity experts show ransomware
attacks are no longer always carried out by one hacker or one group.
Instead, criminals are dividing the work among
specialists who steal passwords, break into company systems, develop hacking
tools and finally steal or lock data to demand ransom.
Cyber security firm ESET, Global Chief Security Evangelist, Tony Anscombe says
the model has created a division of labour within the cybercrime economy, with
criminal groups developing tools that are then supplied to other attackers.
“What happened was there was a
phishing email that came in. They’re doing the phishing piece, getting the
credentials, that initial access piece. The stolen credentials or network
access can then be sold on the dark web to affiliates, who take over the next
stage of the attack,” Anscombe said
According to the experts, affiliates
typically conduct reconnaissance, move laterally across an organisation’s
network and identify valuable data before deciding what to encrypt, damage or
steal.
Behind them are ransomware-as-a-service
operators that develop and provide the tools used in attacks, creating a
cybercrime ecosystem where different players perform specialised functions.
“Ransomware groups develop tools that
can switch off a company’s security systems, then give those tools to other
hackers to use in attacks,” Anscombe said.
These
security systems normally watch computers for signs of hacking and stops suspicious activity.
Hackers are now developing tools that can
disable those protections first, making it easier to break into the
company’s systems and lock or steal its data.
ESET East Africa Lead Cybersecurity
Engineer Allan Juma, said the growing use of vulnerable legitimate drivers
gives attackers a way to undermine security systems that businesses rely on to
protect their networks.
“There are thousands and thousands
of vulnerable drivers out there just waiting to be exploited with just little
effort,” Juma said.
The development means businesses
face a more complex threat because the tools used against them can be sourced
from different parts of the cybercrime ecosystem.
He compared the structure to a
conventional distribution model involving manufacturers, distributors,
resellers and customers, except that the products being exchanged are tools and
services used to compromise organisations.
For Kenyan businesses, the trend
raises the stakes for organisations that have traditionally viewed ransomware
primarily as a technical security problem.
Banks, insurers, telecommunications
firms, retailers and other companies with large volumes of customer and
financial data face the risk of dealing with an entire network of specialised
attackers rather than a single threat actor.
The division of labour also means
that an organisation can be targeted by attackers who did not develop the
malware or initially gain access to its systems.
Juma said the evolution of
ransomware is also being accelerated by artificial intelligence, which is
giving attackers new ways to develop and modify malicious tools.
“Add AI to that particular mix and
you have a potentially limitless source of new variants of these EDR killers,”
he said.
The experts said ransomware
operators are also adapting their tactics quickly to overcome security controls
and environmental obstacles.
Click Here For The Original Source.
