CrowdStrike 2021 Global Threat Report – The Findings
In response to the past year of growing cybersecurity threats, CrowdStrike has released its 2021 Global Threat Report. The report provides vital lessons and recommendations for how security teams can operate in today’s environment in which constantly evolving threats make visibility and speed increasingly important.
Findings in the report suggest that supply chain attacks, ransomware, data extortion and nation-state threats are more abundant than ever. To counter the rapid growth in eCrime, in this year’s annual report, CrowdStrike introduced a new eCrime Index (ECX). The index demonstrates the strength, volume and sophistication of the market and is updated weekly in real-time to help businesses maintain an advantage over their adversaries.
2020’s Most Notable Attack Trends
CrowdStrike’s report covers real-world scenarios and observed tactics in which several key trends stood out. By having an understanding of these trends, businesses can not only become both better informed but can become better placed to meet the challenges that they represent.
1. COVID-19 Themes and Healthcare Sector Became a Target
COVID-19 has had a significant impact on every business and every industry, so it stands to reason that it has impacted the cyber landscape. Fear, concern, and curiosity regarding the pandemic created a valuable subject matter for cybercriminals who used COVID-19 themes in phishing campaigns and lures. CrowdStrike also identified both eCrime and targeted intrusion adversaries explicitly targeting the healthcare industry throughout the past year. Along with the potential disruption to critical functions, the secondary threat of ransomware operations that exfiltrate data was also observed across all sectors.
2. Supply Chain Attacks Continue to be a Major Intrusion Vector
Supply chain attacks have been highlighted as a threat by CrowdStrike since 2018, and 2020 saw them continue to be a major intrusion vector. Software-based attacks enabled malicious actors to propagate to many targets from a single intrusion. Meanwhile, hardware and third-party compromises were also observed. O365 and Azure were consistent targets of one adversary who had a detailed understanding of the authentication and access controls associated with these Microsoft platforms. Supply chain and trusted relationship compromises were identified from both eCrime and targeted intrusion adversaries.
3. Data Extortion Methods Are Being Used by Big Game Hunters
During 2020, Big Game Hunting (BGH) leant increasingly towards incentivising victims to engage in ransom negotiations. Over the course of the year, data theft and the use of Dedicated Leak Sites (DLS) became as deeply implanted in BGH ransomware operations as encryption. While the majority of ransomware operations were opportunistic, more ransomware-associated data extortion operations were seen in the industrial, engineering and manufacturing industries.
CrowdStrike found the eCrime ecosystem to still consist of a vast number of interconnected enterprises often supporting BGH operations. However, a noteworthy development was the pivotal role that access brokers played in supporting a variety of actors in 2020. Also, in 2020, targeted intrusion actors from China, Russia and Iran, among other countries, pursued actions likely related to strategic national security and espionage priorities dictated by their state’s.
Recommendations to Protect Your Business
As well as highlighting the key trends, CrowdStrike’s report puts forward a number of recommendations to help assist businesses in addressing emerging threats and possible vulnerabilities within their systems. Recommendations suggest that security teams should:
- Establish consistent visibility – visibility and speed are critical for blocking attacks within all environments, including the cloud. Security teams should establish consistent visibility and proactively address vulnerabilities.
- Protect identities and access – privilege access management is vital to limit the damage that adversaries can cause. Security teams should ensure the process is robust, implementing multi-factor authentication (MFA) and Zero Trust solutions.
- Invest in expert threat hunting – today’s attacks use stealthy and innovative techniques to evade detection. Security teams should invest in continuous threat hunting to prevent and predict pending attacks.
- Use threat intelligence – humans are behind every attack that takes place. Security teams should try to understand their mindsets by implementing threat intelligence to understand their motivation, skills, and methods.
- Account for remote working – with the rapid adoption of remote working, security policies need to adapt. Security teams should ensure access management and updated privacy considerations are in place for remote workers.
- Build a cybersecurity culture – even with the most robust security technology in place, end users can still be a target. Security teams should employ user awareness programs to combat phishing and social engineering techniques.
What to Expect in 2021
During 2020, not only were adversaries undeterred by COVID-19, but they were also motivated to exploit the situation. In 2021, BGH operations will continue to find ways to maximise their impacts on targets, and both eCrime and targeted intrusion will continue to find new methods to bypass detection.
Threat actors are getting braver and more shrewd by the day. As such, every business needs to employ comprehensive cloud-native technology to stay ahead of the game. To find out more about the challenges your business faces and the recommended defences you need, download the CrowdStrike 2021 Global Threat Report for the full details.
see our
Related resources
Cybersecurity should be front of mind for every organisation, especially in the wake of the current global pandemic. Our ways of working have changed immensely, with a surge in the volume of remote workers using different networks, devices, and platforms. Meanwhile, our businesses are using cloud computing and IoT technologies to facilitate new ways of working, reduce costs, and improve performance. The result is that the attack surface has increased, and with that comes an increase in the volume of cyber threats.
There are images of extensive, verbose documents, complex definitions, and eye-watering Excel sheets when the term GRC is mentioned. For the past two decades, GRC has been central to core business processes across many organisations at both ends of the enterprise spectrum, as well as in the small-to-medium business space in recent times.
But the world has moved on; organisations are forced to embrace digital disruption and agility if they haven’t done so whole-heartedly. And this very disruption is positioning GRC to become less-than-ideal to solve the challenges that said disruption brings with it.
Phishing attacks have increased dramatically over the last few years, with the global pandemic escalating the situation further. Cybercriminals take advantage of insecurities and fear and play on human nature to trick and deceive. In fact, according to the OAIC, phishing attacks that involved compromised credentials accounted for 30% of all cyber incidents in the first half of 2021. And human error formed a major source of these breaches. Unfortunately, due to the clever social engineering tactics used by cybercriminals, technical filters alone aren’t sufficient to protect against phishing.
Mimecast recently released its State of Email Security Report for 2021. The fifth edition of its annual report used interviews with over twelve hundred of information technology and cybersecurity professionals across the globe to gather vital cybersecurity insights. The report offers an insight into the latest email threats along with advice on how to build cyber resilience and mitigate the risks of email-borne attacks.
Secure Access Service Edge, better known as SASE (pronounced sassy – yes that is right) was one of the new security terms on the block in 2019. But it’s actually been around for some time, just without its official moniker. It is expected that by 2024, at least 40% of enterprises will have strategies in place to adopt SASE, according to Gartner.
In this post, Cloud Security Engineer, Will Michail takes a look at why its popularity is increasing now, what the term means and how vendors and organisations are utilising it to enable digital transformation.
We're Here To Help