Understanding Today’s Cyberthreat Landscape

Know the Different Types of Cyberthreats

A cyberattack can hit an organization when they least expect it, which is why proper cybersecurity protection is critical. There are many different types of cyberattacks, and knowing the differences between them is the first step toward understanding how to stop them.

Common types of cyber attacks

Malware describes all malicious software, including spyware, ransomware, viruses, and worms. Malware breaches a network through a vulnerability, typically when a user clicks a dangerous link or email attachment that then installs risky software.

SQL Injection occurs when an attacker inserts malicious code into a server that uses SQL and forces the server to reveal information it normally would not. An attacker could carry out a SQL injection simply by submitting malicious code into a vulnerable website search box.

Man-in-the-Middle Attack (MitM), also known as eavesdropping attacks, occur when attackers insert themselves into a two-party transaction. Once the attackers interrupt the traffic, they can filter and steal data.

Zero-Day Exploit hits after a network vulnerability is announced but before a patch or solution is implemented. Attackers target the disclosed vulnerability during this window of time. Zero-day vulnerability threat detection requires constant awareness.

DNS Tunneling utilizes the DNS protocol to communicate non-DNS traffic over port 53. It sends HTTP and other protocol traffic over DNS. For malicious use, DNS requests are manipulated to exfiltrate data from a compromised system to the attacker’s infrastructure.

What is Ransomware, and why is it so Dangerous?

Different from a standard virus, ransomware is a malicious program designed to block network and computer access to a user or organization. Often designed to spread throughout a connected network of computers, cybercriminals encrypt these files and demand a ransom payment for the decryption key.

Ransomware can affect anyone, including businesses, governments, and even individuals, and while it is possible for people to figure out how to bypass the decryption, doing so often takes time. Most ransomware attacks are successful because organizations are put in a position where paying the ransom is the easiest and cheapest way to regain access to their files.

Know the stats

According to 2021 Data Breach Investigations Report:

of the Ransomware cases involve direct install or installation through desktop sharing apps

of organizations attempted to download at least one piece of known Ransomware last year

The average cost of a ransomware breach is $21,659, but can go all the way up to $650,000

It Can Happen to Anyone

Cybercriminals have been busy, consistently increasing successful ransomware attacks year-over-year. Below are a few high-profile examples, but every industry has been hit and includes all organizations across small and enterprise, non-profits, and government as well. Government, education, and services continue to be hit the hardest, demonstrating a clear continued lack of proper cybersecurity diligence within these industries.

Boggi Milano’s files stolen and held for ransom

Sometimes, cybercriminals get access to sensitive company information and hold it ransom. This very incident happened to Boggi Milano, a premium Italian menswear brand that operates around 200 shops in 38 countries, when a hacker group called Ragnorak infiltrated Boggi Milano’s servers and stole about 40gb of corporate data, including human resource files and salary information.

Acer hit with record ransomware attack

Even technology companies aren’t safe from attacks as computer and phone manufacturing giants Acer were hit with the largest ransomware known to date at $50M. REvil was allegedly behind the attack, and it’s believed that they used Microsoft Exchange server vulnerabilities that hadn’t been updated to breach Acer’s network.

Colonial Pipeline creates mass panic across the US

Easily the most high-profile attack of 2021, the Colonial Pipeline attack, perpetrated by DarkSide, wreaked chaos throughout the US as outages caused a shortage of gas. The largest fuel pipeline in the US, Colonial Pipeline couldn’t afford to the time it would take to get it back online themselves, so opted to pay the $5 million ransom.

Post-Attack Diligence can Make a Difference

Although most ransomware attacks end with the organization paying the ransom, sometimes there are instances where the company works with third party teams to successfully recover the system without being forced to pay. This was the case with Sky Lakes Medical, who were adamant that they were not going to give in to demands. Cisco was brought in to help with the recovery, and within three weeks, all systems were back online and over 2,000 computers in the network had been successfully updated.

This attack was one of a series of attacks the FBI were investigating that affected at least a dozen US hospitals, health systems, and healthcare providers. Many of the others weren’t so fortunate and caved to pay the ransom. It’s one thing when the system decryption keeps computers or gas from being delivered. It’s another entirely when people’s lives are in danger. This is why it’s so critical to engage a comprehensive cybersecurity company like Cisco to protect against threats before cybercriminals can strike.

It can happen to you

Human error is the number one cause of successful cyberattacks. The Sky Lakes Medical attack was initially caused because an employee clicked a link in a well-disguised phishing email. By the time any anomalies were detected, IT systems and computers were running slowly and other systems were already offline.