Simplifying NIST Cybersecurity Standards & Framework

Compliance, Cyber Security / Prayukth K V

Now that cybercrime is becoming more advanced, how can cybersecurity protocols evolve to keep fighting against cyber theft? The National Institute of Standards and Technology’s (NIST) Cybersecurity Framework or CSF was created to help businesses combat cybercrime by providing a standard that they can follow to keep their online resources protected. Even now, the NIST is constantly updating its procedures. Such updates include the release of the NIST SP 800-53A revision, which provides a methodology to ensure and verify that the security and privacy outcomes of organizations are being achieved. These updates are driven by the persistence and evolution of cyber attacks. A write-up on the cybersecurity skills gap by Maryville University notes how businesses are set to lose $8 trillion to cybercrime over the next five years – and very likely more – as we grow increasingly connected in the digital realm. Inadequate cybersecurity coupled with increased internet connectivity heightens the chances of a cyberattack, putting valuable information at risk of falling into the wrong hands. Though the NIST framework is voluntary, businesses should consider adopting the CSF as a structure to figure out cybersecurity measures that suit and serve the organization well. The framework can be tricky to comprehend, so we’ll break its main parts down to make things easier. Understanding NIST CSF The CSF consists of the core, tiers, and profile, aligning cybersecurity activities with your business’s resources and requirements. The Core The core is a set of cybersecurity activities, outcomes, and references to achieve those outcomes. It provides standards, guides, and practices that can be communicated and adopted at all levels of the business. The core’s functions organize basic cybersecurity measures and provide tasks to manage incidents. These are: Within these functions are categories containing specific tasks that need to be accomplished, such as “asset management” and “risk assessment.” Categories are further divided into sub-categories with more particular tasks. Informative references are guidelines and practices to be followed to achieve the outcomes under the sub-categories. Tiers https://www.youtube.com/embed/UfViT53WUR0?feature=oembedOverview of NIST Cybersecurity Implementation Tiers The implementation tiers assess the company’s cybersecurity measures and processes, how well they work and if they adhere to the CSF standards. They range from tier one to four: Knowing which tier your business falls under can help you improve to reach the next tier and eventually achieve more efficient, proactive cybersecurity. Profiles Framework profiles describe the current or desired state of the organization’s cybersecurity protocols. The Current Profile details the business’s cybersecurity outcomes that are presently being achieved. The Target Profile lays out the outcomes that need to be completed to get to the desired cybersecurity management goals. Comparing the two can help address the gaps and areas for improvement to reach the Target Profile. As noted by Virginia Tech, cybercrimes are constantly evolving and not limited to attacks on individuals but on institutions as well. The CSF may be optional, but its standards and practices are essential in protecting your business and its information in the digital age. For more information about the NIST and its revisions, you can check out our post on possible CSF updates. Want to learn more about OT security? Talk to an OT cybersecurity expert from your industry now. We are giving away threat intelligence for free for the next 2 weeks. Find out how you can sign up and try out our threat intelligence feeds Find out what is lurking in your network. Go for a comprehensive 3-layer threat assessment now Join our Cybersecurity Awareness Month campaign See our solution in action through a free demo

Simplifying NIST Cybersecurity Standards & Framework Read More »

Targeted phishing campaigns on the ongoing T-20 world cup tournament

Hackers are running a targeted phishing campaign around the ongoing T-20 World Cup

Cyber Security, Threat Intelligence / Prayukth K V

Hackers have decided to latch on to the excitement generated by the ongoing T-20 World Cup in Australia. Over the last two weeks, Sectrio’s threat research team intercepted/came across 20 emails that were targeted at senior executives from the government, manufacturing, oil and gas, healthcare, and utility sectors. From the data available, we can infer that most emails and WhatsApp messages were targeted against businesses or government entities based in India while Australia, Singapore, and South Africa were ranked 2nd, 3rd, and 4th respectively in terms of the volume of communication reported by recipients. Most emails claimed to know which team would eventually lift the trophy this month and encouraged recipients to use that knowledge to place bets with a leading sports betting agency in England. Once a recipient replies to an email, they are further asked to share personal information (which could be used to hack their online accounts or validate information already harvested from other sources) on the pretext of giving more information. Some of the recipients also received a link that takes them to a website infected with crypto-mining malware. How are the hackers ramping up their targeted phishing campaigns? While topical attacks based on trending sports and geo-political events are not new, this campaign run by hackers adds a new dimension to the problem of protecting businesses against involuntary insider activity that might lead to a compromise of data or credentials. Hackers are clearly ramping up their game in terms of identifying specific trends to use as well as specific targets within organizations to reach out to. While latching on to topics that are more likely to elicit a response, the scammers behind this campaign are also planning to harvest data for long-term targeting. In terms of targeting machines, the malware used was a new version of well-known crypto-mining malware called Nitrokod which has been around for a while now. First detected in 2019, this malware lured victims to download desktop versions of popular mobile apps. Once downloaded, the malware stays latent for a period of almost 45 days keeping a low signature by running multiple processes in the backend to hide its footprint. The actual infection is triggered much later. After a communication line is established with the hacker by the malware, information on the infected machine is passed on. By delaying the infection process, the malware avoids detection in sandbox environments. Sectrio’s threat research team is still evaluating the malware and we will be able to share more information on the new variant soon. We are giving away threat intelligence for free for the next 2 weeks. Find out how you can sign up and try out our threat intelligence feeds Find out what is lurking in your network. Go for a comprehensive 3-layer threat assessment now

Hackers are running a targeted phishing campaign around the ongoing T-20 World Cup Read More »

The truth about cyberattacks on the healthcare sector in India

Cyber Security, Healthcare / Prayukth K V

Cyberattacks on the healthcare sector in India are rising and there are many reasons for this. Right now, India is ranked 11th among the top 20 most targeted nations in the healthcare sector in the world. The IoT and OT global threat landscape assessment report 2022 While the sector has attracted attention from APT actors globally, most attacks are still driven by unaffiliated or loosely affiliated actors who are after a ransom. Healthcare providers, insurers, and even small clinics and online pharma companies are being targeted to obtain information and to target providers and service users. Data criticality and the cost of systems force healthcare organizations to pay up the ransom just to get back on their feet. While some data is floating around on the volume of attacks on this sector in India, we have not seen any data being shared on the actual attacks that were occurring. This is why we have put this post together. a) to help healthcare industry participants understand the nature of the evolving threat landscape in the country and b) to drive awareness on the urgent need to respond to the rising cyber threats and to prevent more attacks from occurring. Here are the top trends and data on attacks on the healthcare sector in India: Why is the healthcare sector being targeted in India? There are many reasons for this. Here are a few: With such a complex modus-operandi, it comes as no surprise that Indian healthcare providers and victims are bleeding PII and more. Such information once leaked will return to haunt the victim and the provider. Sign up for our one-on-one threat intelligence and security landscape briefing to learn more about such attacks. Join our Cybersecurity Awareness Month campaign Find out what is lurking in your network. Go for a comprehensive 3 layer threat assessment now See our solution in action through a free demo

The truth about cyberattacks on the healthcare sector in India Read More »

LockBit 3.0 code release opens Pandora’s box of new threats

Cyber Security, ICS, OT / Prayukth K V

When LockBit 3.0 was launched in June, the group touted it as the most powerful encryptor ever built. The launch also led to a 17 percent rise in cyber incidents directly linked to the encryptor. The new variant brought in new features such as more payment options across cryptocurrencies, new monetization options, and more means to recover or destroy data as per the outcome of negotiations with the victim. The files were not just encrypted but exfiltrated as well to put additional pressure on the victim. A typical attack begins with the victim’s device being infected and the files being encrypted with a jumbled extension. The process of data encryption is done at a rapid speed with multiple tasks being done in parallel. The infection becomes apparent with the wallpaper of the victim’s machine being changed to a ransom note. In case the ransom is not paid on time, the victim’s data is then put up for sale on the Dark Web and other forums. Sample of LockBit 3.0 Ransome Note At the time of writing this blog post, we did come across an APAC enterprise that was successfully targeted by the LockBit 3.0 group. The ransom note asked the victim to pay $10000 to extend the deadline by 24 hours, $500000 to destroy all information, and a similar amount to download the data at any time. LockBit 3.0 was much in demand in Ransomware as a Service market. Which explains the sudden and steep rise in LockBit 3.0-linked attacks. The group even ran a bounty program to incentivize the detection of bugs in its code. LockBit operators were keen on preventing non-group members from obtaining the decryption tool. Since it was first detected in the wild in mid-June, LockBit 3.0 has been reported consistently from over 33 honeypot locations of Sectrio indicating its prevalence and global presence. It even outcompeted rivals such Hiveleaks and Blackbasta in infecting maximum victims since launch as documented by Sectrio’s threat researchers. For a while, everything seemed to be going the way of LockBit 3.0 developers until an alleged disgruntled developer threw a spanner in the works by releasing the code of the encryptor which subsequently made its appearance on Twitter at least a couple of times. This will enable other ransomware groups to build on the encryptor (or modify it) and launch new and more stealthy variants. What’s next for LockBit 3.0 and other ransomware groups? New ransomware groups could theoretically launch their operations with these modified variants. Such variants could also be re-engineered in academic or research labs and in case these variants are accidentally or deliberately released into the web in the future, then the chain of attacks linked to LockBit 3.0 will continue to worry cyber defenders for months or even years.

LockBit 3.0 code release opens Pandora’s box of new threats Read More »

What are Chinese APT groups up to?

Cyber Security, Featured / Prayukth K V

In the last 48 hours, Chinese threat actors APT 27 and 41 have shown extraordinary levels of activity. The fallout from the recent geopolitical events continue to define the sequence of events in the region. APT 27 which is a decade-old threat actor, was at the forefront of the latest spike in cyberattacks on Taiwan. The targets were chosen to create a sense of panic and to showcase the ability of Chinese threat actors to strike anywhere at will. Here is the latest on some of the Chinese threat actors we are tracking: Industrial security on your mind? Find out how your IoT, OT, and IoT deployments can benefit from our converged cybersecurity solution: Request Demo Sign up for our threat intelligence feeds and experience the power of our global honeypot network: Sign up now. Find out what is lurking in your network. Sign up for our threat assessment program.

What are Chinese APT groups up to? Read More »

China assigns APT actors to initiate revenge attacks for the Shanghai police data leak

Cyber Security, Featured / Prayukth K V

As per a series of conversations intercepted by Sectrio’s threat research team from various forums, China is learned to have identified Beijing-based APT 41 and Haikou, Hainan-based APT 40 as nodal cyber offense teams to initiate revenge attacks against many countries. Through these attacks, China may try to gain control over the narrative that has emerged in wake of the recent revelation of a large data breach that has impacted over a billion Chinese citizens. Who are the Chinese APT groups targeting? These attacks may primarily be aimed against countries with whom China has had an uneasy relationship in the past. It could also include a few other countries to enhance the magnitude of the breach and to bring in an element of plausible deniability. Understanding the Shanghai Police data leak incident It may be remembered that in one of these most expansive breaches reported so far, the data belonging to nearly a billion Chinese citizens was breached some time ago. The 23 TB of data, a sample of which was released online, belonging to the Shanghai police department includes names, phone numbers, government ID, and law enforcement reports of citizens. An extortion attempt was made and hackers who asked the Police department to pay $200,000 to prevent the data from being leaked to a wider audience. China is known to keep massive amounts of data concerning its citizens and persons of interest from around the world in databases with various levels of security. In this instance, it is claimed that while the database was protected, a dashboard linked to the database was not. Also read: How to get started with OT security On Friday, the site where the data was put for sale removed the post advertising the data for sale. The site however indicated that it has other databases that it is willing to sell to prospective buyers. The scale of the breach left many questions unanswered primarily regarding the security of information collected by the government. While it has not made any direct references to the breach, China did ask all public bodies and citizen information managers to secure all information submitted to the government so that people and businesses feel safe while sharing their data with the government of China or public bodies under it. In addition to increasing confidence in the government’s ability to securely harvest and store data, China is also getting ready to go on the offensive to prove that such breaches can happen to the citizens of any country. This will also help China downplay the gravity of the original event while offering Chinese social platforms a convenient diversionary topic to discuss. Gameplan Revenge China is planning to launch new ransomware families and multi-loader malware for this operation. The designated APT groups identified for this breach campaign are APT 40 and 41. APT 40 also goes by monikers BRONZE MOHAWK, FEVERDREAM, G0065, Gadolinium, GreenCrash, Hellsing, Kryptonite Panda, Leviathan, MUDCARP, Periscope, Temp.Periscope, and Temp.Jumper. In the past, it has targeted government agencies, healthcare facilities, AI-based projects and even scientific research. APT 40 is no stranger to harvesting stolen data and is known to maintain a long-term reconnaissance presence extending to many victims in countries considered to be adversaries by the PRC government. This also includes friendly countries that have signed up for the Belt and Road initiative and nations that have received aid from China in one form or another. Also read: Complete Guide to Cyber Threat Intelligence Feeds APT 40 actors often employ non-malicious tools in non-standard folders as part of an attack. Thus, if the location of a non-malicious tool is found to be non-standard, the tool becomes an IOC for a breach. The malware libraries used by APT 40 are often shared with other Chinese APT groups. Post-breach data is also shared with other groups as a standard practice. Beijing-based APT 41 AKA Double Dragon Barium, Winnti, Wicked Panda, Wicked Spider, TG-2633, Bronze Atlas, Red Kelpie, Blackfly) is known to have links with the Chinese Ministry of State Security (MSS). Between 2021 and the early months of 2022, this group is known to have conducted extensive operations against the governments of the US, Canada, a few NATO member states, and the UK. This group is known to have multiple breach tactics in its inventory and is hard to detect. This group also has the capacity to modify a malware post-injection to work in conjunction with the host environment and adapt to any changes that the victim may make to their networks. Also read: Why IoT Security is Important for Today’s Networks? Both these groups are well versed in large-scale data harvesting, processing, and transfer of data and are known to be among the most stealthy APT groups in China. This is why China has chosen them to carry out a series of revenge attacks across many countries. These attacks could occur as early as this month as China seeks to bury the Shanghai Police leak episode. The speed with which these actors were assigned to this project indicates a sense of urgency. The gameplan: Learn more about these actors in our 2022 IoT and OT Threat Landscape Assessment Report Go for a complete threat assessment program now to learn about the threats lurking in your network Learn more about Key Advanced Persistent Threat (APT) Clusters Under Observation explained by Prayukth K V, Speaker & Published Author cybersecurity, CMO, Sectrio, the market leader in IoT, OT & IT Security.

China assigns APT actors to initiate revenge attacks for the Shanghai police data leak Read More »

Black Basta ransomware is mutating, and this has several implications

Cyber Security / Prayukth K V

New variants of the Black Basta ransomware are now emerging in the wild and routinely turning up in our global honeypots. According to online reports, Black Basta has managed to make many victims pay a ransom across US, Singapore, UAE, UK, India, and Australia since it was first discovered in the wild in February 2022. Its emergence as a massive threat within just 2 months of its launch points to a new trend. Hackers are betting on faster hit-and-run tactics to draw large sums of money as ransom within a short period of time, sell the code to other groups and move on (either to develop new malware or for an extended vacation). The malware development and release cycles have been shrunk in response to law enforcement agencies targeting third-party platforms involved in money laundering and the conversion of cryptocurrencies. As law enforcement agencies are tracking the movement of money, hackers are aware that they have less time to encash their stolen wealth and exit the ecosystem. Also read: How to get started with OT security Black Basta is targeting a wide range of victims across verticals such as manufacturing, transportation, utilities, maritime, and government agencies. It has also been associated with at least one phishing campaign targeting oil and gas pipeline companies based in Europe. Discovering multiple Black Basta variants Sectrio’s threat research team has discovered multiple Black Basta variants including 2 which seemed to have been developed exclusively for ransomware-as-a-service end-use (with two back doors). The RaaS version has extensively targeted corporate networks and sensitive data and access credentials. Data is first exfiltrated and then the encryption process is initiated. A newer variant released in late May is targeting virtual machines running on Linux servers. This variant works to encrypt multiple servers instantly by searching for /vmfs/volumes or locations housing VMs within these servers. The list of victims is published on a blog site (Basta news) maintained by the actors behind this ransomware. While the overall operations seem to be copied from the playbooks of threat actors such as the notorious Conti ransomware group, the emergence of multiple variants indicates ongoing research designed to develop more potent variants to meet specific end-user requirements of hackers. Also Read: Complete Guide to Cyber Threat Intelligence Feeds A glut of new variants could also confuse threat detection engines and threat researchers. We suspect that the Basta group has already moved on from this ransomware and that the development work has been subcontracted to other groups for a commission or other considerations. After multiple cycles of variations (some of which could be AI-driven), the ransomware will be completely unrecognizable and may slip through existing signature-based detection mechanisms. If such updates are then passed on to other variants, then the detection challenge will grow exponentially and single ransomware can bring many industries and agencies to a complete halt if adequate cybersecurity measures are not already in place. To find out if your IoT, OT, and IT deployments are secure and protected from Black Basta and other potent ransomware, schedule a comprehensive threat assessment program with Sectrio. Book a demo now to see our IoT-OT-IT converged cybersecurity solution in action

Black Basta ransomware is mutating, and this has several implications Read More »

Learn more about Sectrio Award winning solution

Sectrio’s IoT OT, and IT Security solution wins NASSCOM Gamechanger 2022 award

Cyber Security / Prayukth K V

Sectrio’s unique AI-powered IoT and OT security solution based on the Adaptive Threat Defense approach has been recognized as a game-changing technology by NASSCOM. The solution won the top honor at an event organized by NASSCOM last week (June 23). In addition, the solution use cases presented by Sectrio have ranked number one by NASSCOM in the use of AI in the cybersecurity category well ahead of over 300 competitors. This honor is another validation of the uniqueness of the solution as well as its ability to evolve in-situ to stay aligned with emerging threats and changes in the threat environment including the addition of new adversaries, malware, malware deployers, mutational threats, and rogue insider activity. The solution has been developed to tackle the most sophisticated threats that threaten IT, OT, and IoT assets and infrastructure. Its features have been enriched with inputs from our diverse customer base around the globe and its evolutionary and self-learning feature enables it to reach unprecedented levels of scale when it comes to tackling complex and sophisticated malware and adversaries. With the rise in threats and complexity of infrastructure, CISOs are having to deal with multiple challenges such as network visibility, working with the right threat intelligence, detecting threats early, and evolving security measures to keep their security posture current and relevant. In this context, the Sectrio solution is the only OT and IoT cybersecurity solution that can help CISOs and enterprises keep their businesses safe by keeping threats at bay. Unique features of Sectrio’s Adaptive Threat Defense solution include: Based on adaptive technology that scales to meet new threats and risks Secures all surfaces across devices and networks irrespective of protocols or device architectures Detects and engages threats early using a unique detection framework and mechanism Utilizes the most comprehensive and contextual threat intelligence feeds generated from the largest IoT and OT-focused honeypot network in the world Multiple remedial actions are available Zero detection lag, minimizes false positives, and reduces SOC fatigue Aligned with the most critical security standards spanning NIST frameworks, IEC 62443, and multiple ISO requirements The solution is capable of scaling in a ‘J’ shaped curve in terms of devices and network elements covered Offers protection against evolutionary malware, modular malware, and latent malware through footprint grade baselining Deployed across industries such as manufacturing, maritime, critical infrastructure, banking, utilities, maritime and more The only that offers proven evolutionary protection i.e protection that is scalable, robust, and vector proof To learn how this award-winning IoT-OT-IT cybersecurity solution can secure your enterprise, book a no-obligation demo now. You can also opt for an IoT and OT threat assessment program from Sectrio to understand your threat envelope, vulnerability status, and exposure to various risks as a first step. Learn more about our threat assessment methodology here: OT and IoT Threat Assessment Read more about this award at the Government of India’s AI portal. Read more and download the NASSCOM AI Gamechanger Compendium!

Sectrio’s IoT OT, and IT Security solution wins NASSCOM Gamechanger 2022 award Read More »

How to get started with OT security

Cyber Security, ICS, OT / Prayukth K V

In the last couple of years, OT security has managed to get plenty of attention from security teams. Some businesses have even started having dedicated teams to manage OT security and tools. However, many businesses are still in the process of figuring out a strategy to deal with OT threats and specific risks to infrastructure and networks. This article will shed some light on how to improve OT security without putting strain on your existing resources. Where to start? In a manufacturing plant in the APAC region that was attacked in May last year, security teams were unable to agree on which tool to choose for securing OT systems. This resulted in a prolonged delay in decision-making. The teams met over 22 times in 6 months without being able to come to a consensus on the way forward. In every meeting, the IT security team, the SCADA and ICT team, and the CISO’s nominee would discuss and agree to disagree on these points: The IT team wanted to go with the existing vendor who was offering an untested and unproven solution for OT security for free The SCADA team wanted to go for a proven OT solution but the CISO’s nominee was not comfortable with the budgets that were being sought The logjam continued for almost 200 days till a cyberattack crippled their plant operations. The assembly line sustained much damage but luckily since the plant was not operational during late evening after work hours, no loss of life was reported. The teams holding disparate opinions on how to deal with OT security came together and agreed on a line of approach immediately and thus, the plant got a new security solution in just 23 hours and that was not all. A cybersecurity audit for all systems including vulnerability scans was conducted and everyone chipped in to identify new security standards to readily embrace to keep the focus on OT security going. Lesson: move fast. Learn rapidly, decide early, and execute with diligence without wasting any time. Even small steps implemented early can lead to incremental OT security gains. On the other side, the more you delay, the greater are your chances of falling victim to a debilitating attack. Also read: The 2022 global threat landscape report 1. Conduct an OT threat assessment By doing a comprehensive OT threat assessment exercise, you will be able to identify and understand the threats, their sources as also the level of intervention required to deal with them. Sectrio can help with a custom threat assessment for your business. Share a few details here to get started. 2. Know your network and assets OT and associated networks often harbor devices that have not been part of any inventory for years. We have seen power plants and manufacturing shop floors host complex OT devices serving simple functions that may once have been part of an inventory but are now transparent to the security operations team and to inventory managers. There could be two reasons for this: These devices are no longer playing a major role in the overall scheme of things (though they are still connected to the overall network) Or such devices are part of a sub-inventory that is managed separately Without an integrated inventory, it becomes difficult to know what to protect which might add major gaps to the security posture of a business. Over a period of time, such devices are not just forgotten but they are also not maintained in any way and certainly not patched. Lesson: put an inventory together of all assets without any discrimination. 3. Publish an OT security policy Publishing an OT security policy will serve many purposes. It can be a statement of intent as also a statement of direction and confidence in the need to address OT security. We have put together a template for you here that you can readily use. The OT security policy can very well be the first step but always ensure that there are regular follow-ups to draw and act on action items. If this is not done, then the policy will remain on paper and will not be of much help to the organization. The OT security policy should be action-oriented. 4. Investigate and patch all vulnerabilities Every vulnerability is an invitation to a hacker to exploit and attack. Run frequent scans for detecting vulnerability and patch status of devices. Act on the vulnerabilities detected and patch all unpatched devices. Calendarize such scans and also check the CVE DBs frequently for any new vulnerabilities that may be associated with the devices in your network. These are essential parts of your overall cyber hygiene and must be given adequate priority. 5. Integrate OT risk exposure into your institutional risk management plan All OT risks identified should be part of the institutional plan along with identified timelines for addressing these risks. OT risks can be addressed in isolation at a tactical level if they do not have any dependency on the overall infrastructure (which is rarely the case). Risks related to device patching for instance can be handled as part of an OT security plan but that plan has to connect with the institutional risk management plan at a strategic level. This will ensure more visibility for OT risks and also help in generating awareness on the need to address OT risks. 6. Identify standards and mandates to comply with All security measures should have benchmarks to look up to. This is where NIST CSF, IEC 62443, and many ISO measures come into play. Many countries are now passing legislation mandating businesses to comply with new and stringent reporting requirements. Even before that, businesses need to look at streamlining their security measures and align them with the best standards out there. This will give your security team added motivation as well. When you declare your organization to be say IEC62443 compliant, it will also give your customers more confidence to engage your organization. 7. Work with the right threat intelligence

How to get started with OT security Read More »

The future of IoT ransomware – targeted multi-function bots and more cyberattacks

Cyber Security, IoT / Prayukth K V

A new IoT malware was detected in October 2021 with as many as 30 exploit mechanisms that were coded into it. This malware called BotenaGo was able to seek out and attack vulnerable targets by itself without having to rely on any human intervention. Once it infects a device, it creates two backdoor ports viz., Ports: 31412 and 19412. It will then use port 19412 to listen and roll through programed exploit functions and execute them in sequence. BotenaGo is an autonomous malware which means that it doesn’t need any human intervention once it is released. This malware was released accidentally by its developers and could very well be a beachhead malware I.E., malware that opens the infrastructure to another wave of devastating attacks. This was just the preview. Sectrio’s Threat Research team has come across new propagation and exploit strategies that hackers are using to target IoT deployments exclusively. Gone are the days when hackers were using highjacked devices to only launch attacks on selected targets. Today, in addition to DDoS attacks, highjacked devices are used for a variety of illegal uses by hackers including sending unsolicited SMS messages, sending traffic to sites to boost their traffic numbers, promoting spam links, and more. Contracted hackers work by offering two modes. In the first mode, a fixed number of highjacked bot devices are offered to prospective buyers for pre-decided uses. The availability of devices is guaranteed in this mode with the hacker promising to add more devices to compensate for the loss of any device due to the cyberattack being detected. In the second mode, a range of devices or a certain compute power is but on the block by a hacker. The hacker doesn’t care about the end use in this mode. This is to cater to cyber criminals who wish to scale up or ramp down their operations based on various factors. Read more: Why IoT Security is important for today’s network IoT multi-loader malware in development can increase the number of malware that can be deployed and cover more exploits as well. The hackers have invested more time and money in building more potent malware in the last two years. Some of these developments were funded via ransom crypto money received from victims. With the ongoing crash in the value of cryptocurrency, hackers may turn more desperate and release some of these malware in the test cycles well before its planned release. Weak IoT security practices don’t help Even now, we are seeing many IoT proof of concept projects that are taking off without adequate security. Devices are connected online with default credentials, network baselining is not done and no attempt is made to revisit user and device privileges or to check device vulnerability status. The hackers are well aware of these weaknesses and their playbook in fact focuses on overwhelming cyber defenses with newer malware and breach tactics to keep security operations teams busy in the cleanup. What can be done to improve IoT security? We have discussed this topic extensively in the past. What is needed is enterprise-wide awareness of the distance hackers have covered in the last two years and how they are just waiting for one slip up before striking and creating havoc. In addition to awareness, here are a few more things to do to secure IoT: Worried about IoT security? Let our IoT security threat assessment specialists help you now. Reach out for a special custom package now. Stay ahead of hackers: detect all those IoT threats early with our IoT-focussed threat intelligence feeds. Sign up now. Talk to us to understand how our IoT and OT security solutions can improve your risk management and security posture. Try our threat intelligence feeds for free for 15 days to see what your threat hunting program is missing here: Sign up for FREE threat intelligence feeds Learn more about our threat assessment methodology here: OT and IoT Threat Assessment Book a demo now to see our IT, OT and IoT security solution in action: Request a Demo Try our threat intelligence feeds for free for the next two weeks. Get access to enriched IoT-focused cyber threat intelligence for free for 15 days

The future of IoT ransomware – targeted multi-function bots and more cyberattacks Read More »

By Industry

By Compliance

Business Needs

Services

Contact Us