New findings from Trellix’s CyberThreat Report: November 2023 from its Advanced Research Centre indicates that collaboration is taking place between ransomware groups and nation-state-backed advanced persistent threat (APT) actors.
They are believed to be adopting and using lesser-known programming languages for malware, with cybercriminals developing generative AI (GenAI) tools.
“As technology advances, so does cybercrime – and understanding the changing landscape is vital for CISOs and SecOps teams to stay ahead of threats,” says John Fokker, head of threat intelligence at Trellix Advanced Research Centre. “Cybercriminals are becoming increasingly more agile, organised, and politically aligned. It is imperative defenders refer to threat intelligence to strengthen their security posture with limited resources.”
The latest Trellix Advanced Research Center’s CyberThreat Report finds:
* Malicious GenAI: Cybercriminals bypass protections to take advantage of commonly-known tools and use GenAI to enhance phishing campaigns. The accelerating scale and speed of phishing attacks indicates malicious GenAI may already be in deployment today.
* Geopolitical Threat Activity: Nation-state threat activity spiked over 50% in the last six months due to conflict escalation in Russia and Ukraine, intensified cyber activity in Israel just before and during the conflict, and disruptive attacks on Taiwan heading into their 2024 elections.
* Ransomware Developments: Global detections and industry-reported incidents, particularly in Q2, reflect unusual variations in ransomware families, as well as countries and industries targeted. The Trellix Advanced Research Centre also observed a splintering of large ransomware groups, with the introduction of smaller groups and more attacks focused on data exfiltration.
* Underground Collaboration: The last six months demonstrated an increase in threat actors actively collaborating on Dark Web forums. This spanned groups formally joining together (“The Five Families”), an escalation in selling/sharing of zero-day vulnerabilities, joint PoC development efforts to accelerate exploitations, and more.
* Polyglot Malware: Cyber, a polycrisis itself, is a threat multiplier – and the rise of polyglot malware further exacerbates this. New programming languages are becoming popular malware choices, with Golang seeing high usage for ransomware (32%), backdoors (26%), and Trojan Horses (20%).