Check Point Research’s (CPR) 2022 Security Report details the primary attack vectors and techniques witnessed by CPR during 2021. From supply chain attacks to ransomware, organizations experienced 50% more weekly cyber attacks than in 2020. Key highlights from the report include the return of Emotet, cracks in the ransomware ecosystem and vulnerabilities in cloud services. Software vendors saw the largest year-on-year growth (146%) in 2021. CPR emphasizes the need for more cohesive security following December’s Log4J exploits and recent REvil arrests.
The report reveals the key attack vectors and techniques witnessed by CPR during 2021.
In a year that began with the fallout from one of the most devastating supply chain attacks in history, we’ve seen threat actors grow in confidence and sophistication. This culminated in the Log4j vulnerability exploit which, yet again, caught the security community off-guard and brought to the fore the sheer level of risk inherent in software supply chains. In the months between, we saw cloud services under attack, threat actors increasing their focus on mobile devices, the Colonial Pipeline held to ransom, and the resurgence of one of the most dangerous botnets in history. But it’s not all doom and gloom. We also saw cracks in the ransomware ecosystem widen in 2021, as governments and law enforcement agencies around the world resolved to take a tougher stance on ransomware groups in particular. Instead of relying on reactive and remedial action, some shocking events woke governments up to the fact that they needed to take a more proactive approach to dealing with cyber risk. That same philosophy extends to businesses too, who can no longer afford to take a disjointed, siloed, reactionary approach to dealing with threats. They need 360-degree visibility, real-time threat intelligence, and a security infrastructure that can be mobilized in an effective, joined-up manner.
The recent arrests made in Russia of the REvil ransomware gang is a unique event in the history of cyber as it is the first time that the US Administration has collaborated with the Russian authorities to track down and arrest members of a ransomware group. Coming about one year after the Emotet group was taken down there are some key differences and one worrying similarity. First, on this occasion, actual arrests of the ringleaders have been made and assets have been seized like high performance cars large amounts of cash and crypto currency. However, you cannot arrest code. It only takes one or two members or affiliates of the gang to escape with the key attack tools for REvil to re-merge at a later date, possibly in another country. We can only hope this is not the case. The main positive take from this situation is that any ransomware gang that thought Russia was a ‘safe haven’ for them to practice their malicious trade will have to think again. This comes on the back of Ukraine closing down similar ransomware gangs in that country. It’s certainly not the end of ransomware, but every measure that governments can take, by sharing intelligence, to restrict such criminal activity is to be welcomed.