Quarterly cybersecurity threat update: Jan 2024
The final quarter of 2023 saw a continuation of familiar cyberthreats, alongside the emergence of some concerning new trends.
Ransomware remained a prevalent issue, evolving to target broader victim pools and adopt ‘double extortion’ tactics. Phishing scams became more sophisticated, exploiting current events and leveraging psychological manipulation. Zero-day vulnerabilities exposed the ever-present need for vigilant patching and security updates. While these threats pose challenges, understanding them and practising basic cybersecurity hygiene can significantly reduce your risk.
Significant cyberthreats this quarter
Ransomware
This notorious threat continues to grow, with the highest number of listed victims ever recorded in November, according to multiple cybersecurity insurance firms. Threat actors are now utilising ‘double extortion’ tactics that threaten not only data encryption but also public release of sensitive information. The financial sector was hit particularly hard, with attacks disrupting services and causing costly downtime.
Related news articles
British Library ransomware attack: The British Library was the victim of a cyberattack that disrupted its services and compromised user data.
Ransomware attacks on the rise: Reports of a surge in ransomware attacks in November 2023 due to factors like the resurgence of the LockBit gang and the exploitation of CitrixBleed vulnerability
SEC complaint: Ransomware group reports their victim for failure to disclose the breach
Phishing
Phishing scammers are becoming ever more adept at mimicking legitimate sources and exploiting current news stories. Scams related to holiday shopping over the Christmas period and the ongoing geopolitical climate were on the rise this quarter. Attackers are employing increasingly sophisticated techniques to bypass traditional email filters and deceive victims.
Related news articles
Phishing and AI tools: AI-powered tools like ChatGPT are fuelling a massive surge in sophisticated phishing emails, making online scams harder to spot and potentially costing businesses billions.
Quishing: A rising cyberthreat where QR codes enable phishing attacks and information theft.
Zero-day exploits
Zero-day exploits pose a significant threat, as they target vulnerabilities with no known patches or solutions. The discovery in Q4 of weaknesses in widely-used software, such as Google Chrome and Apple’s iOS, demonstrates the importance of promptly installing security updates as soon as they become available.
Related news articles
Google Chrome’s eighth zero day of 2023: Another critical Chrome zero-day vulnerability has been exposed and exploited by attackers, urging immediate update.
Apple zero-day vulnerability: Apple fixed two critical security vulnerabilities in iOS through emergency software updates.
Emerging threats
Supply chain attacks
These attacks target the weakest links in an organisation’s ecosystem, often through third-party vendors or embedded software, to gain access to sensitive data, disrupt operations, or cause financial harm. Supply chain attacks are on the rise and becoming increasingly sophisticated and dangerous, posing a significant threat to companies across all industries.
Related news articles
Supply chain attacks warning: The UK and South Korea have jointly issued a warning about North Korean state-linked cyber actors targeting software supply chains.
2023’s largest supply chain attack: Tens of thousands of employees at some of Britain’s biggest companies have had their personal data compromised
Artificial Intelligence (AI)
Malicious actors are increasingly harnessing the power of AI in their attacks, highlighting the risk that comes with AI’s cybersecurity potential. AI-powered attackers evade detection through real-time adaptation, automate exploitation for widespread impact and craft hyper-realistic phishing content. Significant effort is being made to develop countermeasures against these evolving, automated and deceptive threats.
Related News Articles
Phishing evolution: Generative AI may be used to create more convincing phishing attacks
AI and cybersecurity: How AI could significantly impact cybersecurity, with both positive and negative consequences.
Security Tips and Recommendations
• Install security patches and updates as soon as they become available.
• Use unique and complex passwords for all accounts, and implement two-factor authentication whenever possible.
• Never click on suspicious links or open unexpected attachments. Be wary of emails claiming to be from legitimate sources, even if they appear credible.
• Regularly back up your important data to a secure location to minimize the impact of a ransomware attack.
• Stay informed: Keep yourself updated on current cybersecurity threats and best practices. Consider subscribing to reputable security blogs or newsletters.
• Get a clear picture of any vulnerabilities with a cybersecurity audit of your systems
Remember, even basic cybersecurity awareness can significantly improve your defence against cyberthreats. By adopting these simple practices and staying informed, you can proactively protect yourself and your data in the ever-evolving digital landscape.
Additional Resources
National Cyber Security Centre (NCSC)
