THANK YOU FOR SUBSCRIBING
Manufacturing Technology Insights | Wednesday, March 29, 2023
Manufacturing is the most attacked industry in the Asia-Pacific region, leading to an increase in cyber threats and attacks due to economic and geopolitical disruptions.
FREMONT, CA: With 48 per cent of reported attacks, manufacturing is the most targeted industry in the Asia-Pacific region, followed by finance and insurance with 18 per cent. The key method of attack was spear phishing using attachments, accounting for 40 per cent of reported incidents. In 2022, the Asia-Pacific region remained the most targeted area for cyber attacks, accounting for 31 per cent of all incidents resolved globally. This marks the second successive year that the region has held this distinction.
Stay ahead of the industry with exclusive feature stories on the top companies, expert insights and the latest news delivered straight to your inbox. Subscribe today.
The attacker's top action last year was developing backdoors, which allow for remote access to systems, accounting for 31 per cent of cases. This was followed by ransomware, which accounted for 13 per cent of cases. Globally, most of the observed attempts to position backdoors were futile ransomware attempts. This indicates that defenders were able to detect the backdoors before the ransomware could be deployed. The high value of the market is one of the prime reasons for the increase in backdoor deployment. The backdoor access was sold by threat actors for up to dollar 10,000, compared to credit card data, which was sold for less than dollar 10.
The focus on detection and response has enabled defenders to interrupt attackers earlier in the attack cycle, thereby limiting the impact of ransomware attacks in short-term impact. The shift towards detection and response has allowed defenders to disrupt adversaries earlier in the attack chain and mitigate the progression of ransomware in the short term, it's only a matter of time before backdoors become the next ransomware crisis. Attackers are always finding novel ways to avoid detection, which means businesses must adopt a proactive, threat-driven security strategy to stay ahead of the game and break free from the never-ending cycle of attacks. Simply relying on good defence is no longer sufficient.
An increase in the number of cyber threats that are becoming more sophisticated, because cyber attackers are exploiting economic and geopolitical disruptions. The Asia-Pacific region will continue to increase in both the number and refinement of cyber threats due to economic and geopolitical disruptions. Therefore business leaders need to take immediate action to protect themselves against such malicious attacks. This involves a comprehensive approach that includes reducing their attack surfaces, being prepared for specific threat actors and techniques that target their industry or location, and conducting regular offensive testing to detect potential attack paths into their systems.
The Primary Trends
Extortion - Threat Actor's go-to Method: In 2022, the most frequent result of cyberattacks was extortion, which was mainly accomplished via ransomware or business email compromise attacks.
Cybercriminals Weaponise Email Conversations: There is a significant increase in thread hijacking in 2022. This involves attackers gaining access to email accounts and posing as the original participant in ongoing conversations. The monthly attempts at this type of attack increased by 100 per cent compared to the data from the previous year.
Legacy Exploits Still doing the Job: The proportion of known exploits compared to vulnerabilities has decreased by 10 per cent from 2018 to 2022. This decrease is due to the increasing number of vulnerabilities recorded in 2022, indicating that legacy exploits were still being utilized to enable the spread of older malware such as WannaCry and Conficker.
Extortion Pressure Applied (Unevenly): Extortion schemes are frequently targeted by cybercriminals in the most vulnerable industries, businesses, and regions, using psychological pressure to force their victims to pay.
In 2022, the manufacturing industry was the most targeted industry for extortion and was also the most attacked industry for the second year in a row. Due to the low tolerance of manufacturing organisations for downtime, they are particularly vulnerable to extortion schemes.
The use of ransomware for extortion is a common method employed by threat actors, but they are continuously exploring new ways to extract ransom from their victims. One of the recent tactics involves making stolen data more accessible to downstream victims, such as customers and business partners. This tactic puts more pressure on the breached organization to comply with the attackers' demands.
Threat actors will continue experimenting with downstream victim notifications to increase the potential costs and psychological impact of an intrusion – making it critical that businesses have a customised incident response plan that also considers the impact of an attack on downstream victims.
Thread Hijacking on the Rise: There is a significant increase in email thread hijacking activity in 2022. The monthly rate of attempts by attackers doubled compared to the previous year. This tactic was used to deliver malware such as Emotet, Qakbot, and IcedID, which are often associated with ransomware infections.
Last year, phishing was the primary cause of cyberattacks, and there was a significant increase in thread hijacking, which shows that attackers are taking advantage of the trust placed in emails. To mitigate this risk, businesses should educate their employees about thread hijacking to reduce the chances of them becoming a victim.
Mind the Gap - Exploit “R&D” Lagging Vulnerabilities: Over the last few years, the ratio of known exploits to vulnerabilities has been decreasing and it is now 10 percentage points lower than it was in 2018.
There are more than 78,000 known exploits that cybercriminals can use to target vulnerabilities in computer systems. This makes it easier for them to exploit older vulnerabilities that have not been patched. Even after five years, vulnerabilities that enabled WannaCry infections are still posing a significant threat.
The fact that cybercriminals are still exploiting older, known vulnerabilities emphasises the importance of organisations improving their vulnerability management programmes. This includes gaining a better understanding of their attack surface and prioritising patches based on risk.
Manufacturing is the most attacked industry in the Asia-Pacific region for the second consecutive year. The increase in cyber threats and attacks due to economic and geopolitical disruptions caused by the pandemic. A proactive, threat-driven security strategy, and refining and maturing vulnerability management programmes to better understand attack surfaces and prioritise patches. Additionally, the report highlights the rise of thread hijacking and the continued use of older exploits by cybercriminals.
More in News
Manufacturing Technology Insights Weekly Brief
Be first to read the latest tech news, Industry Leader's Insights, and CIO interviews of medium and large enterprises exclusively from Manufacturing Technology Insights
