Cybercrime

We all know that bad bots are, well… Bad. But open banking is supposed to be good, giving consumers more control over their finances. Combine open banking and bad bots though and you have opened up a world of new threats to banks, customers, and their data.

We spoke to Alan Ryan, AVP for UK and Ireland at Imperva, about how open banking has created new opportunities for cybercriminals, and why the traditional siloed approach to security needs re-appraising.

Cybercriminals have launched approximately 7.9 million DDoS attacks in the first half of 2023, representing a 31 percent year-on-year increase.

A new report from NETSCOUT shows global events like the Russia-Ukraine war and recent NATO bids have driven recent DDoS attack growth.

It won't come as any surprise that there's a thriving market among threat actors for the latest vulnerability exploits. A new report from Flashpoint lifts the lid on this world and reveals the exact vulnerability exploits that were listed for sale, purchased, and/or traded in the first half of 2023.

One of the most expensive was a remote code execution exploit for Adobe Commerce -- the eCommerce platform formerly known as Magneto -- which was listed for sale at $30,000. A Citrix ShareFile exploit was priced at $25,000.

Over half of the UK population (53 percent) would be supportive of the UK government and its allies breaking international cybersecurity law.

A new survey by Censuswide, on behalf of International Cyber Expo, also shows 45 percent have admitted they would be supportive of, or engage in online cybercriminal activity themselves, in the right circumstances.

As workers take time off for summer holidays it means greater risk that personal devices and public Wi-Fi will be used to access sensitive corporate data.

Vulnerability management specialist Hackuity warns that this is a time when organizations are at their most vulnerable and cybercriminals are well aware of the fact.

We've already seen how generative AI can be used in cyberattacks but now it seems there's an AI model aimed just a cybercriminals.

Every hero has a nemesis and it looks like ChatGPT's could be FraudGPT. Research from security and operations analytics company Netenrich shows recent activities on the Dark Web Forum reveal evidence of the emergence of FraudGPT, which has been circulating on Telegram Channels since July 22nd.

A new report from GuidePoint Security shows a startling 100 percent increase in publicly posted ransomware victims from Q2 2022 to the last quarter.

The study from the GuidePoint Research and Intelligence Team (GRIT) also shows a 38 percent increase in public victims compared to Q1 of this year.

Recent Salesforce research shows 52 percent of consumers expect their offers to be personalized. To create these tailored offerings and drive a seamless customer experience, retailers gather vast amounts of personally identifiable information (PII) -- from addresses to purchasing history and payment information. This makes them an irresistible -- and relatively low risk -- target for cybercriminals. As a result, data breaches within retail are increasingly common, even for major retailers -- as we saw earlier this year with the JD Sports Data Breach, which exposed the PII of around 10 million people.

To help protect consumers, governing bodies are putting increased pressure on companies to comply with data protection rules -- including the UK’s upcoming Data Protection and Digital Information Bill. Consumer trust is key when it comes to retail too. So, companies unable to protect their customer data not only risk enormous fines, but significant damage to their brand reputation. So, following recent high-profile retail breaches, how can brands protect their customers’ personal data? 

While IT security leaders are concerned about attacks that use malware-exfiltrated authentication data, many still lack the necessary tools to investigate the security and organizational impact of these infections and effectively prevent follow-on attacks.

Research from cybercrime analytics company SpyCloud shows 98 percent of over 300 mid-market and enterprise IT security professionals from the US and UK surveyed say better visibility into at-risk applications would significantly improve their security posture.

Whoever said 'crime doesn't pay' clearly did so before the advent of the internet. A new report shows that if cybercrime was a country it would be the third largest global economy, valued at $10.5 trillion by 2025. Some 33 billion records are estimated to be stolen in 2023 -- a huge increase of 175 percent from 2018.

The latest Cybercrime Statistics Report from Independent Advisor, shows that last year the cost to US businesses of an average cyberattack amounted to a huge $4.35 million. In addition, 83 percent of organisations got attacked more than once.

A new report from cloud risk and detection specialist Rapid7 reveals that Japanese businesses have become a significant target for state-sponsored cyberattacks.

This increased vulnerability has been driven by a fragile global economy and increased political and diplomatic tensions. The Japanese automotive industry and financial services sectors are of particular interest to these actors due to their global reach.

The increasing sophistication of cybercriminals significantly influences the rise in cybercrime, the frequent lack of sufficient cybersecurity measures, and the high profitability of cybercrime. Cybercriminals constantly refine their skills, developing advanced malware and phishing techniques to bypass security protocols. This progress often outpaces many businesses' and individuals' ability to safeguard their digital assets -- as a lack of resources, underestimation of risk, or insufficient awareness often results in inadequate cybersecurity measures. Further fueling this upward trend is the lucrative nature of cybercrime, with offenders able to amass significant profits from stolen money or data, often with a low risk of apprehension due to the anonymity of the internet and digital currencies. 

A recent BlackBerry Global Threat Intelligence Report observed up to 12 attacks per minute from December 2022 to February 2023, and the number of unique attacks using new malware samples skyrocketed by 50 percent -- from one per minute in the previous report to 1.5 per minute during this reporting period. The most common weapons were droppers, downloaders, remote access tools (RATs), and ransomware, with the most significant target being the healthcare industry.

The construction sector (with an average of 226 incidents annually) is the most targeted by cyber criminals closely followed by transport (167), wholesale trade (138), manufacturing (116) and retailers (105).

A new report from ReliaQuest, based on data from 35,000 incidents affecting its clients, shows the most detected attack technique is the attempted exploitation of exposed remote services, such as virtual private networks (VPNs) and remote desktop protocol (RDP).

After a decrease of eight percent in cyber extortion (Cy-X) victims in 2022, the data for the first quarter of this year shows the largest volumes to date.

The latest Cy-Xplorer 2023 report from Orange Cyberdefense shows businesses in 96 different countries were impacted by Cy-X in 2022. Since 2020 Orange Cyberdefense has recorded victims in over 70 percent of all countries worldwide.

A new report uncovers a worrying 25 percent increase in the total number of new vulnerabilities published in 2022.

The latest Vulnerability and Threat Trends Report from the Skybox Security Research Lab shows 25,096 new vulnerabilities published last year, representing the largest year-on-year rise seen since 2017.