ENISA Threat Landscape 2020 - Main Incidents

From January 2019 to April 2020

Main incidents in the EU and worldwide

ENISA Threat Landscape

Overview

The sophistication of threat capabilities increased in 2019, with many adversaries using exploits, credential stealing, and multistage attacks. The number of data breach incidents is still very high,

and the amount of stolen financial information and user credentials is growing. In some cases, the failure to patch a known vulnerability that has the potential to affect software or libraries in use - in a reasonable timeframe – may have serious repercussions.

During the past decade, malware has made ENISA’s list of top 15 threats, yet still many security systems are not able to detect this threat. For many years, malware was spread mainly through malicious

e-mail spam and more recently, using finely crafted phishing messages. Technology companies and e-mail providers alike invested in spam filters, improving the detection of malicious attachments. However,

adversaries are now innovating to increase their chances of reaching potential victims. Many of these innovations have paid back

to malicious actors during this period.

The COVID-19 pandemic has put healthcare organisations and professionals worldwide under pressure, and health has become one of the most critical sectors to protect against cyberattacks. The number of incidents involving ransomware targeting the healthcare sector was already high but increased during the pandemic.

__Top data breaches incidents

Cloud service MEGA 770 ElasticSearch Server Breach 108 Canva Data Breach 139 Chinese Job Seekers MongoDB 202 Indian Citizens MongoDB… 275 Dream Market Breach 620 Verifications.io Data Breach 808 0 200 400 600 800 1,000 millions of records

Timeline

2019 _ January _ February _ March _ October _ September _ August 2020 _ November _ December _ January _ April _ May _ July _ June _ February _ March _ April

Most targeted sectors

_In the line of fire

The sectors most targeted sectors during this period were digital services, government administration and the technology industry. Attacks on digital service providers often serve as proxies to reach other, more attractive targets. In contrast, attacks on the technology industry allowed malicious actors to compromise the supply chain or look for vulnerabilities to exploit.

Over 770 million e-mail addresses and 21 million unique passwords were exposed in a popular hacking forum hosted by the cloud service MEGA . It became the most significant collection of breached personal credentials in history, named ‘Collection #1’.

The cloud and virtualisation provider Citrix was a victim of a targeted

cyberattack. To gain access to Citrix’s systems, the attackers exploited several critical software vulnerabilities such as CVE-2019-19781 and employed a technique called password spraying.

__Most targeted sectors

Digital Services_ Services such as e-mail, social and collaborative platforms and cloud providers were under attack during 2019. These were also used as proxies for further attacks.

Government Administration_ The financial

returns from ransoms paid makes the public sector one of the most attractive targets for ransomware attacks. Technology Industry_ The technology industry was under attack in 2019 mainly through supply chain attacks trying to compromise the development of software through zeroday exploits and backdoors attacks. Financial_ The number of incidents with financial organisations and not necessarily banks, increased substantially during the reporting period. Healthcare_ The number of attacks against the healthcare sector continues to grow.

Trends

_Across the board

 In 2019, intense trojan-activity was observed across the globe. Emotet and Agent Tesla were the most frequently and dangerous  malwares .   Phishing remained one of the most successful techniques for delivering malicious tools. Powerful phishing lures include phone scams, fake invoices, payments, quotations and purchase and sales orders.   Ransomware continues to generate substantial financial rewards for malicious actors. A recent study identified human-operated ransomware campaigns , in which adversaries employ credential theft and lateral movement methods traditionally associated with targeted attacks such as those from nation-state actors.  Card-skimming schemes have become a significant threat during 2019 and 2020 due to the increasing number of online shoppers.  Business e-mail compromise (BEC) is a growing threat as a result of the vast amount of credentials and personal information stolen during the last decade.  Companies experience an average of 12 credential-stuffing attacks each month, wherein the attacker is able to identify valid credentials.

__Findings 84%_of cyberattacks rely on social engineering 67%_of malware was delivered via encrypted HTTPS connections 230.000_new strains of malware every day 6_months in average is what it takes to detect a data breach of organizations experienced 71%_ malware activity that spread from one employee to another

Actors

_Who

Knowing who is responsible or attributing responsibilities to a person or a group for a cybersecurity incident is still a very daunting task and often a worthless exercise. Yet, from a threat intelligence perspective, it is essential to classify behaviours, understand the dynamics and modus operandi used by certain adversaries. This analysis often helps defenders to look for specific tracks and try to anticipate the next adversarial action.

The Lazarus Group for example, an allegedly state-sponsored advanced

persistent threat (APT) group, was reportedly more active during the reporting period in both financially and espionage motivated attacks. The group has been associated with several incidents, including the

AppleJeus campaign targeting cryptocurrency trading platform users

and their systems. Major incidents attributed to this group include:  hacking an Indian nuclear power plant and space research organisation in November 2019;  compromising a cryptocurrency trading app targeting exchange administrators in October 2019;  attacking automated teller machines (ATMs) and banks in India, identified in September 2019;  targeting Android users in South Korea through trojanised apps in the Google Play Store identified in August 2019.

__Most active actors

Organized crime

16%

Other

4%

Insider

8%

System admin

60%

10% End user

2%

Nation state

Motivations

_Why

While it is challenging to determine the primary motivation behind a cyberattack, we can still categorise them based on the outcome of the incident.

Financial: The number of incidents resulting in the theft of information, data and user credentials is the highest observed during the reporting period. In most cases, the intention is to steal data/information and sell it on the dark web. Other uses of this information/data to enable other types of attacks with a completely different outcome such as espionage or financial fraud, can also be identified. More than 620 million account details were stolen from 16 hacked websites and offered for sale on the popular dark-web marketplace Dream Market.

Espionage: This is a motive behind an increasing number of reported attacks, mainly due to ongoing geopolitical and commercial tensions. The number of incidents is not substantial, but their size and magnitude put it second in ENISA’s list of top 5 motivations. Some noteworthy incidents include that reported in April 2019, in which a General Electric’s employee and a Chinese businessperson were charged by the United States Department of Justice with economic espionage and theft of General Electric’s trade secrets. AgenceFrance Presse (AFP) reported that Airbus had fallen victim to a sophisticated cyber-espionage campaign. Attackers reportedly breached the IT systems of several of Airbus’s suppliers and, from there, penetrated the company’s IT systems.

Top five motivations: financial, espionage, disruption, political and retaliation. __Top motivations

The figure below shows that Financial is still the primary motive for the majority of cyberattacks. In some cases, multiple motivations can be identified within a single attack. For example, espionage, political, financial and disruption are often combined motives. Many incidents originate from automated systems and are delivered ‘as-a-service’, paid in cryptocurrency. These services include distribution of ransomware, command and control (C2), distributed denial of service (DDoS), spam and other illicit activities.

financial

Attack vectors

_How

Cyberattacks take on average three steps to reach a victim’s valuable assets. When reviewing the most frequently used attack vectors, we must prioritise the entry point, course of action and action on assets. These are the most critical stages that should constitute distinct approaches in a defence strategy.

Entry point: During 2019, the techniques used most frequently to start

a cyberattack include brute force with stolen credentials, social engineering, configuration errors and exploitation of web applications. The exploitation of web applications, for example, was often used as an entry point because of the growing uptake of this type of application to transfer data to the cloud. Errors in cloud configuration and misuse of systems were essential entry point in a large number of incidents. The use of social engineering to plan an attack leverages from tools such as phishing and business e-mail compromise (BEC) . Other techniques less frequently but equally important are the exploitation of vulnerabilities (from unpatched systems and zero-days) and software backdoors, often used in more complex and sophisticated attacks.

Course of action: Installing malware is the technique most widely used

during the ‘course of action’ stage. Once installed, it helps the adversary to do reconnaissance, move around the victim’s systems and networks, install additional tools such as ransomware, steal data and communicate with a C2 server.

__ most desired assets by

Five

cybercriminals 01_Industrial property and trade secrets 02_State/military classified information 03_Server infrastructure 04_Authentication data 05_Financial data

Strategic intelligence

_What changed in the landscape with the covid-19 pandemic?

In 2019, ENISA continued mapping the threat landscape, helping decision-makers and policymakers define strategies to defend citizens, organisations and cyberspace. This work is part of ENISA’s strategy to provide strategic intelligence to its stakeholders. The central theme in 2019 was the next generation of mobile telecommunications, or 5G, following a request from the European Commission and Member States.

The agency will continue to produce these thematic threat landscapes and in 2020, the focus is on artificial intelligence.

The COVID-19 pandemic has been a prolific period for malicious actors conducting attacks targeting sensitive areas such as healthcare service providers and people working from home. ENISA is mapping the threat landscape experienced during the pandemic and advising on mitigation measures that will attempt to reduce the exposure to threats.

ENISA shares its cybersecurity recommendations on the COVID-19 pandemic on a variety of topics including working remotely, online shopping and e-health, and it provides valuable up to date security advice to the sectors affected.

The Brno University Hospital in the Czech Republic suffered a

cyberattack in the midst of the COVID-19 pandemic, which forced it to reroute patients and postpone surgery. The incident is considered critical since this Hospital is one of the Czech Republic's biggest COVID- 19 testing laboratories.

_COVID-19 threat landscape

ENISA prepared many resources for an awareness-raising campaign and shared other internal and external resources dedicated to cybersecurity experts, covering security issues associated with challenges faced during the COVID-19 pandemic. One of these resources was an analysis of the most critical threats during this period.

References Related

ENISA Threat Landscape Report The year in review ENISA Threat Landscape Report List of Top 15 Threats ENISA Threat Landscape Report Research topics ENISA Threat Landscape Report Sectoral and thematic threat analysis ENISA Threat Landscape Report Emerging trends ENISA Threat Landscape Report Cyber Threat Intelligence overview

RelatedOther publications

Roadmap on the Cooperation Between CSIRTS and LE EU MS Incident Response Development Status Report ENSIA CSIRT maturity assessment model “The sophistication of threat capabilities increased in 2019, with many adversaries using exploits, credential stealing, and multistage attacks.”

About

_ The agency

The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found at www.enisa.europa.eu.

Contributors

Christos Douligeris, Omid Raghimi, Marco Barros Lourenço (ENISA), Louis Marinos (ENISA) and all members of the ENISA CTI Stakeholders Group: Andreas Sfakianakis, Christian Doerr, Jart Armin, Marco Riccardi, Mees Wim, Neil Thaker, Pasquale Stirparo, Paul Samwel, Pierluigi Paganini, Shin Adachi, Stavros Lingris (CERT EU) and Thomas Hemker.

Editors

Marco Barros Lourenço (ENISA) and Louis Marinos (ENISA).

Contact

For queries on this paper, please use enisa.threat.information@enisa.europa.eu. For media enquiries about this paper, please use press@enisa.europa.eu.

Legal notice

Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the Regulation (EU) No 526/2013. This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

Copyright Notice

© European Union Agency for Cybersecurity (ENISA), 2020 Reproduction is authorised provided the source is acknowledged. Copyright for the image on the cover: © Wedia. For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders.

ISBN: 978-92-9204-354-4 DOI: 10.2824/552242