ENISA Threat Landscape 2021

ABOUT ENISA

The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu.

CONTACT

For contacting the authors, please use etl@enisa.europa.eu. For media enquiries about this paper, please use press@enisa.europa.eu.

EDITORS

Ifigeneia Lella, Marianthi Theocharidou, Eleni Tsekmezoglou, Apostolos Malatras – European Union Agency for Cybersecurity

CONTRIBUTORS

Claudio Ardagna, Stephen Corbiaux, Andreas Sfakianakis, Christos Douligeris

ACKNOWLEDGEMENTS

We would like to thank the Members and Observers of the ENISA ad hoc Working Group on Cyber Threat Landscapes for their valuable feedback and comments in validating this report. We would also like to thank the ENISA Advisory Group and the National Liaison Officers network for their valuable feedback. We would also like to thank the ENISA Situational Awareness and Incident Notification teams for their active contribution and support in consolidating different pieces of information into the threat landscape.

LEGAL NOTICE

Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or ENISA bodies unless adopted pursuant to the Regulation (EU) No 2019/881. ENISA may update this publication from time to time.

Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

COPYRIGHT NOTICE

© European Union Agency for Cybersecurity (ENISA), 2021 Reproduction is authorised provided the source is acknowledged. For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders.

ISBN: 978-92-9204-536-4 – DOI: 10.2824/324797 – ISSN: 2363-3050

ENISA THREAT LANDSCAPE 2021

TABLE OF CONTENTS

1. THREAT LANDSCAPE OVERVIEW 7

1.1 PRIME THREATS 8

1.2 KEY TRENDS 9

1.3 EU PROXIMITY OF PRIME THREATS 10

1.4 PRIME THREATS PER SECTOR 11

1.5 METHODOLOGY 13

1.6 STRUCTURE OF THE REPORT 14

2. THREAT ACTOR TRENDS 16

2.1 STATE-SPONSORED ACTORS 16

2.2 CYBERCRIMINALS 23

2.3 HACKER-FOR-HIRE ACTORS 30

2.4 HACKTIVISTS 31

3. RANSOMWARE 34

3.1 TRENDS 35

3.2 RECOMMENDATIONS 43

4. MALWARE 46

4.1 TRENDS 46

4.2 RECOMMENDATIONS 49

5. CRYPTOJACKING 51

5.1 TRENDS 51

5.2 RECOMMENDATIONS 54

6. E-MAIL RELATED THREATS 56

6.1 TRENDS 56

ENISA THREAT LANDSCAPE 2021

6.2 RECOMMENDATIONS 58

7. THREATS AGAINST DATA 61

7.1 TRENDS 62

7.2 RECOMMENDATIONS 64

8. THREATS AGAINST AVAILABILITY AND INTEGRITY 67

8.1 TRENDS 67

8.2 RECOMMENDATIONS 72

9. DISINFORMATION - MISINFORMATION 75

9.1 TRENDS 78

9.2 RECOMMENDATIONS 79

10.NON-MALICIOUS THREATS 82

10.1 TRENDS 84

10.2 RECOMMENDATIONS 85

A ANNEX: MITRE ATT&CK 88 B ANNEX: MAJOR INCIDENTS 97 ENISA THREAT LANDSCAPE 2021

EXECUTIVE SUMMARY

This is the ninth edition of the ENISA Threat Landscape (ETL) report, an annual report on the status of the cybersecurity threat landscape that identifies prime threats, major trends observed with respect to threats, threat actors and attack techniques, and also describes relevant mitigation measures. In the process of constantly improving our methodology for the development of threat landscapes, this year’s work has been supported by a newly formatted ENISA ad hoc Working Group on Cybersecurity Threat Landscapes (CTL).

The time span of the ETL 2021 report is April 2020 to July 2021 and is referred to as the "reporting period" throughout the report. During the reporting period, the prime threats identified include:

 Ransomware  Malware  Cryptojacking  E-mail related threats  Threats against data  Threats against availability and integrity  Disinformation – misinformation  Non-malicious threats  Supply-chain attacks

In this report we discuss the first 8 cybersecurity threat categories. Supply chain threats, the 9th category, were analysed in detail, due to their particular prominence, in a dedicated ENISA report “ENISA Threat landscape for Supply Chain Attacks” .

For each of the identified threats, attack techniques, notable incidents and trends are discussed along with proposed mitigation measures. As regards trends, during the reporting period we highlight the following:

 Ransomware has been assessed as the prime threat for 2020-2021.  Governmental organisations have stepped up their game at both national and international level.  Cybercriminals are increasingly motivated by monetisation of their activities, e.g. ransomware. Cryptocurrency remains the most common pay-out method for threat actors.  Malware decline that was observed in 2020 continues during 2021. In 2021, we saw an increase in threat actors resorting to relatively new or uncommon programming languages to port their code.  The volume of cryptojacking infections attained a record high in the first quarter of 2021, compared to recent years. The financial gain associated with cryptojacking incentivised threat actors to carry out these attacks.  COVID-19 is still the dominant lure in campaigns for e-mail attacks.  There was a surge in healthcare sector related data breaches.  Traditional DDoS (Distributed Denial of Service) campaigns in 2021 are more targeted, more persistent and increasingly multivector. The IoT (Internet of Things) in conjunction with mobile networks is resulting in a new wave of DDoS attacks.  In 2020 and 2021, we observe a spike in non-malicious incidents, as the COVID-19 pandemic became a multiplier for human errors and system misconfigurations, up to the point that most of the breaches in 2020 were caused by errors.

Understanding the trends related to threat actors, their motivations and their targets greatly assists in planning cybersecurity defences and mitigation strategies. This is an integral part of our overall threat assessment, since it

ENISA THREAT LANDSCAPE 2021

allows security controls to be prioritised and a dedicated strategy to be devised based on the potential impact and likelihood of threat materialisation. With this in mind, for the purposes of the ETL 2021, the following four categories of cybersecurity threat actors are considered:

 State-sponsored actors  Cybercrime actors  Hacker-for-hire actors  Hacktivists

Through continuous analysis, ENISA derived trends and points of interest for each of the major threats presented in the ETL 2021. The key findings and judgments in this assessment are based on multiple and publicly available resources which are provided in the references used for the development of this document. The report is mainly targeted at strategic decision-makers and policy-makers, but it will also be of interest to the technical cybersecurity community.

ENISA THREAT LANDSCAPE 2021 ENISA THREAT LANDSCAPE 2021

1. THREAT LANDSCAPE OVERVIEW

In its ninth edition, the ENISA Threat Landscape (ETL) report provides a general overview of the cybersecurity threat landscape. The ETL report is partly strategic and partly technical, with information relevant to both technical and nontechnical readers. This year’s work has been supported by a newly formatted ENISA ad hoc Working Group on Cybersecurity Threat Landscapes (CTL) .

Cybersecurity attacks have continued to increase through the years 2020 and 2021, not only in terms of vectors and numbers but also in terms of their impact. The COVID-19 pandemic has also –expectedly– had an impact on the cybersecurity threat landscape. One of the more enduring developments that resulted from the COVID-19 pandemic is a lasting shift to a hybrid office model. Therefore, cybersecurity threats related to the pandemic and exploiting the “new normal” are becoming mainstream. This trend has increased the attack surface and, as a result, we have seen a rise in the number of cyber-attacks targeting organisations and companies through home offices .

In general, cybersecurity threats are on the rise. Spurred by an ever-growing online presence, the transitioning of traditional infrastructures to online and cloud-based solutions, advanced interconnectivity and the exploitation of new features of emerging technologies such as Artificial Intelligence (AI) , the cybersecurity landscape has grown in terms of sophistication of attacks, their complexity and their impact. Notably, the threat to supply chains and their significance due to their potentially catastrophic cascading effects has reached the highest position among major threats, so much so that ENISA produced a dedicated threat landscape for this category of threat .

It is worth noting that in this iteration of the ETL, particular focus has been given on the impact of cyber threats in various sectors, including the ones listed in the Network and Information Security Directive (NISD). Interesting insight may be drawn from the particularities of each sector when it comes to the threat landscape, as well as potential interdependencies and areas of significance. Accordingly, sectorial threat landscapes merit further attention.

There have also been some notable steps from the side of defenders in the cyber community this year, as well as the policy makers. The global community has begun to realise the importance of communication and cooperation in examining and tracking cybercriminals, with ransomware (the most prominent threat for the reporting period of ETL 2021) in particular becoming a prime item in agendas for meetings on strategy among global leaders.

Dedicated readers of past editions of the ETL 2021 will notice a difference in the mapping of prime threats. This year, ENISA took a step back and consolidated threat categories in a move towards integration and better representation of similar threats. This is part of ongoing efforts towards a revamped threat taxonomy and will help in establishing trends methodologically over the next few years.

The ETL 2021 is based on a variety of open-source information and cyber threat intelligence sources. It identifies major threats, trends and findings, and provides relevant high-level mitigation strategies. ENISA is currently working on solidifying the methodology for reporting on the threat landscape to promote transparency and consistency in the work.

ENISA THREAT LANDSCAPE 2021 1.1 PRIME THREATS

A series of cyber threats emerged and materialised in the course of 2020 and 2021. Based on the analysis presented in this report, the ENISA Threat Landscape 2021 identifies and focuses on the following 8 prime threat groups (See Figure 1). These 8 threat groups are highlighted because of their prominence during the reporting period, their popularity and the impact that materialisation of these threats has had.

 Ransomware Ransomware is a type of malicious attack where attackers encrypt an organisation’s data and demand payment to restore access. Ransomware has been the prime threat during the reporting period, with several high profile and highly publicised incidents. The significance and impact of the threat of ransomware is also evidenced by a series of related policy initiatives in the European Union (EU) and worldwide.  Malware Malware is software or firmware intended to perform an unauthorised process that will have an adverse impact on the confidentiality, integrity, or availability of a system. The threat of malware has been consistently ranked high for many years, albeit at a decreasing rate during the reporting period of ETL 2021. The use of new attach techniques and some major wins for the law enforcement community have impacted the operations of relevant threat actors.  Cryptojacking Cryptojacking or hidden cryptomining is a type of cybercrime where a criminal secretly uses a victim’s computing power to generate cryptocurrency. With the proliferation of cryptocurrencies and their ever-increasing uptake by the wider public, an increase in corresponding cybersecurity incidents has been observed.  E-mail related threats E-mail related attacks are a bundle of threats that exploit weaknesses in the human psyche and in everyday habits, rather than technical vulnerabilities in information systems. Interestingly and despite the many awareness and education campaigns against these types of attacks, the threat persists to a notable degree. In particular, the compromise of business e-mails and advanced sophisticated techniques in extracting monetary gains are on the rise.  Threats against data This category encompasses data breaches/leaks. A data breach or data leak is the release of sensitive, confidential or protected data to an untrusted environment. Data breaches can occur as a result of a cyber-attack, an insider job, unintentional loss or exposure of data. The threat continues to be high, since access to data is a prime target for attackers for numerous reasons, e.g. extortion, ransom, defamation, misinformation, etc.  Threats against availability and integrity Availability and integrity are the target of a plethora of threats and attacks, among which the families of Denial of Service (DoS) and Web Attacks stand out. Strictly related to web-based attacks, DDoS is one of the most critical threats to IT systems, targeting their availability by exhausting resources, causing decreases in performance, loss of data, and service outages. The treat is consistently ranked high in the ENISA threat landscape, both because of its manifestation in actual incidents and its potential for high impact.  Disinformation – misinformation Disinformation and misinformation campaigns are on the rise, spurred by the increased use of social media platforms and online media, as well as a result of the increase of people’s online presence due to the COVID-19 pandemic. This group of threats is making its first appearance in the ETL; however its importance in the cyber world is high. Disinformation and misinformation campaigns are frequently used in hybrid attacks to reduce the overall perception of trust, a major proponent of cybersecurity.  Non-malicious threats Threats are commonly considered as voluntary and malicious activities brought by adversaries that have some incentives to attack a specific target. With this category, we cover threats where malicious intent is not apparent. These are mostly based on human errors and system misconfigurations, but they can also refer to physical disasters that target IT infrastructures. Also attributed to their nature, these threats have a constant presence in the annual threat landscape and are a major concern for risk assessments.

ENISA THREAT LANDSCAPE 2021

Figure 1: ENISA Threat Landscape 2021 - Prime threats

It needs to be noted that the aforementioned threats involve categories and the collection of threats, consolidated into the eight areas mentioned above. Each of the threat groups is further analysed in a dedicated chapter of this report, which elaborates on its particularities and provides more specific information, findings, trends, attack techniques and mitigation vectors.

1.2 KEY TRENDS

The list below summarises the main trends observed in the cyber threat landscape during the reporting period. These are also reviewed in detail throughout the various chapters comprising the ENISA threat landscape of 2021.

 Highly sophisticated and impactful supply chain compromises proliferated, as highlighted by the dedicated ENISA Threat Landscape on Supply Chain. Managed service providers are high-value targets for cybercriminals.  COVID-19 drove cyber espionage tasking and created opportunities for cybercriminals.  Governmental organisations have stepped up their game at both national and international level. Increased efforts have been observed from governments to disrupt and take legal action against statesponsored threat actors.  Cybercriminals are increasingly motivated by monetisation of their activities, e.g. ransomware. Cryptocurrency remains the most common pay-out method for threat actors.  Cybercrime attacks increasingly target and impact critical infrastructure.  Compromise through phishing e-mails, and brute-forcing on Remote Desktop Services (RDP) remain the two most common ransomware infection vectors.  The focus on Ransomware as a Service (RaaS) type business models has increased over 2021, making proper attribution of individual threat actors difficult.  The occurrence of triple extortion ransomware schemes increased strongly over the course of 2021.

ENISA THREAT LANDSCAPE 2021

 The malware decline that was observed in 2020 continues during 2021. In 2021, we saw an increase in threat actors resorting to relatively new or uncommon programming languages to port their code.  Malware targeting container environments have become much more prevalent, with novel evolutions like file-less malware being executed from memory.  Malware developers keep finding ways to make reverse engineering and dynamic analysis harder.  The volume of cryptojacking infections attained a record high in the first quarter of 2021, compared to the last few years. The financial gain associated with cryptojacking incentivised the threat actors to carry out these attacks.  The volume of Crypto mining in 2021 and cryptojacking activities are at a record high.  We can see that a shift from browser to file-based cryptojacking is taking place.  COVID-19 is still the dominant lure in campaigns for e-mail attacks.  Business E-mail Compromise (BEC) has increased, has grown in sophistication and become more targeted.  The Phishing-as-a-Service (PhaaS) business model is gaining prevalence.  Threat actors shifted their attention towards vaccine information in the context of threats to data and information.  There was a surge in healthcare sector related data breaches.  Traditional DDoS (Distributed Denial of Service) attacks are moving towards mobile networks and IoT (Internet of Things).  Ransom Denial of Service (RDoS) is the new frontier of denial of service attacks.  Sharing of resources in virtualised environments acts as an amplifier of DDoS attacks.  DDoS campaigns in 2021 have become more targeted and much more persistent and increasingly multivector.  Artificial Intelligence (AI)-enabled disinformation supports attackers in carrying out their attacks.  Phishing is at the heart of disinformation attacks and strongly exploits people’s beliefs.  Misinformation and disinformation are at the core of cybercrime activities and is increasing at an unprecedented rate.  Disinformation-as-a-Service (DaaS) business model has grown significantly, spurred by the increasing impact of the COVID-19 pandemic and the need to have more information.  In 2020 and 2021, we observed a spike in non-malicious incidents, as the COVID-19 pandemic became a multiplier for human errors and system misconfigurations, up to the point that most of the breaches in 2020 were caused by errors.  There has been a spike in cloud security non-malicious incidents.

1.3 EU PROXIMITY OF PRIME THREATS

An important aspect to consider in the context of the ENISA Threat Landscape involves the proximity of a cyber threat with respect to the European Union (EU). This is particularly important to assist analysts in assessing the significance of cyber threats, correlate them with potential threat actors and vectors and even to guide the selection of appropriate targeted mitigation vectors. In line with the proposed classification for the EU Common Security and Defence Policy (CSDP) , we classify cyber threats into four categories as illustrated in Table 1.

Table 1: Classification of proximity of cyber threats

Proximity Concerns

Affected networks, systems, controlled and assured within EU borders. Affected population within

NEAR

the borders of the EU.

Networks and systems considered vital for operational objectives within the scope of the EU digital single market and the NISD sectors, but their control and assurance relies on non-EU

MID

institutional or MS public or private authorities. Affected population in geographical areas close to EU borders.

ENISA THREAT LANDSCAPE 2021

Proximity Concerns

Networks and systems that, if influenced, will have a critical impact on operational objectives within the scope of the EU digital single market and the NISD sectors. Control and assurance of

FAR

those networks and systems lies beyond EU institutional or Member States’ (MS) public or private authorities. Affected population in geographical areas far from the EU.

GLOBAL All the aforementioned areas

Figure 2 illustrates a timeline of incidents related to the prime threat categories reported in the ETL 2021. It should be noted that the information in the graph is based on OSINT (Open Source Intelligence) and is a result of work by ENISA in the area of Situational Awareness .

Figure 2: Timeline of observed incidents related to major ETL threats (OSINT-based situational awareness) in terms of their proximity.

As evidenced by the above figure, 2021 has seen a higher number of incidents compared to 2020. In particular, the category NEAR has a constantly rising number of observed incidents related to prime threats, which implies their significance in the context of the EU. Unsurprisingly, the monthly trends (not shown in the figure for brevity) are quite similar among the different classifications since cybersecurity knows no border and in most cases threats materialise at all levels of proximity. It is noteworthy that, during the last months covered by ETL 2021, a higher EU NEAR proximity is observed, a trend that ENISA will continue monitoring to see how it evolves and how it relates to the activities of threat actors and ongoing threat vectors.

1.4 PRIME THREATS PER SECTOR

Cyber threats are usually not restricted to one particular sector and in most cases affect more than one of them. This is indeed true since in many cases the threats manifest themselves by exploiting vulnerabilities in underlying ICT systems that are being used in a variety of sectors. However, targeted attacks as well as attacks exploiting the differences in cybersecurity maturity across sectors and the popularity/prominence of certain sectors, are all factors that need to be considered. These factors contribute to threats manifesting themselves as incidents in specific sectors

ENISA THREAT LANDSCAPE 2021

and this is why it is important to look deeply into sectorial aspects of observed incidents and threats. Moreover, trends noticed in each sector and cross-sector dependencies are observations that may be drawn from such an analysis.

Figure 3 and Figure 4 highlight the affected sectors concerning incidents observed based on OSINT (Open Source Intelligence) and is a result of work by ENISA in the area of Situational Awareness . They refer to incidents related to the prime threats of ETL 2021. This is the first attempt by ENISA to map the impact of threats on specific sectors. In the coming years and in future iterations of the threat landscape, efforts will be made to align the sectors with the ones listed in the Network and Information Security Directive (NISD) and the proposal for its review (NISD 2.0).

Figure 3: Timeline of observed incidents related to prime ETL threats in terms of the affected sector.

ENISA THREAT LANDSCAPE 2021

Figure 4: Targeted sectors per number of incidents (April 2020-July 2021)

During this reporting period, a large number of incidents targeted public administration and government and digital service providers. The latter is to be expected given the horizontal provisioning of services for this sector and thus its impact on many other sectors. We also observed a significant number of incidents targeting end users and not necessarily a particular sector. The health sector was also targeted significantly, and this activity shows signs of increasing during the last few months of the reporting period (May-July 2021). Interestingly, the finance sector faces a consistent number of incidents throughout the year. The supply chain of software also shows an increased number of incidents during 2021, which is also an observation in the ENISA Supply Chain threat landscape report .

1.5 METHODOLOGY

The ENISA Threat Landscape (ETL) 2021 report is based on information available from open sources, mainly of a strategic nature and ENISA’s own Cyber Threat Intelligence (CTI) capabilities, and covers more than one sector, technology and context. The report attempts to be industry and vendor agnostic and references or cites the work from various security researchers, security blogs and news media articles throughout the text in multiple footnotes. The time span of the ETL 2021 report is April 2020 to July 2021 and is referred to as the "reporting period" throughout the report.

For the production of the ETL 2021 report, the following approach was used. Throughout the relevant time period ENISA, by means of situational awareness, gathered a list of major incidents as they appeared in open sources. This list served as the foundation for the identification of the list of prime threats, as well as the source material for several trends and statistics in the report.

Subsequently, an in-depth desk research of available literature from open sources such as news media articles, expert opinion, intelligence reports, incident analysis and security research reports was conducted by ENISA and external experts. Through continuous analysis, ENISA derived trends and points of interest for each of the major threats presented in ETL 2021. The key findings and judgments in this assessment are based on multiple and publicly available resources which are provided in the references used for the development of this document.

ENISA THREAT LANDSCAPE 2021

Within the report, we try to differentiate between what has been reported by our sources and what is our assessment. (We do so by specifically using the phrase “in our assessment”). Finally, when conducting an assessment, we convey probability by using words that express an estimate of probability (e.g. likely, very likely, certainly) .

MITRE ATT&CK® framework was used in this report to highlight the attack tactics and techniques relevant to a given threat (see Annex A). For each ATT&CK® tactic, the techniques the adversary used are presented. This can lead to a list of ATT&CK Mitigations that can be applied. MITRE ATT&CK® is a knowledge base, a common language for adversarial tactics and techniques based on real-world observations. The MITRE ATT&CK® knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cybersecurity product and service community.

The report was validated by the ENISA Ad Hoc Working Group on Cyber Threat Landscapes that was established in April 2021, a group that consists of experts from European and international public and private sector entities.

For the future development of Threat Landscapes, ENISA is in the process of formalising a new methodology, to promote transparency and set the foundations for structured and well-aligned processes. In this endeavour, together with a revised threat taxonomy, the methodology for threat landscapes will be made public in the future.

1.6 STRUCTURE OF THE REPORT

The ENISA Threat Landscape (ETL) 2021 has maintained the structure of previous ETL reports by using a similar structure for highlighting the prime cyber threats in 2021. Readers of past iterations will notice that the threat categories have been consolidated in line with a move towards a new cybersecurity threat taxonomy to be used in the future.

This report is structured as follows:

Chapter 2 explores the trends related to threat actors (i.e. state-sponsored actors, cybercrime actors, hacker-for-hire actors and hacktivists). Chapter 3 discusses major findings, incidents and trends regarding ransomware. Chapter 4 presents major findings, incidents and trends regarding malware. Chapter 5 describes major findings, incidents and trends regarding cryptojacking. Chapter 6 highlights major findings, incidents and trends regarding e-mail related threats. Chapter 7 discusses major findings, incidents and trends regarding threats to data. Chapter 8 presents major findings, incidents and trends regarding threats against availability and integrity. Chapter 9 underlines the importance of hybrid threats and describes major findings, incidents and trends regarding disinformation and misinformation. Chapter 10 focuses on major findings, incidents and trends regarding non-malicious threats. Annex A presents the techniques commonly used for each threat, based on the MITRE ATT&CK® framework. Annex B includes notable incidents per threat, as observed during the reporting period.

ENISA THREAT LANDSCAPE 2021 ENISA THREAT LANDSCAPE 2021

2. THREAT ACTOR TRENDS

Cyber threat actors are an integral component of the threat landscape. They are entities aiming to carry out a malicious act by taking advantage of existing vulnerabilities, with the intent to do harm to their victims. Understanding how threat actors think and act, what their motivations and goals are, is an important step towards a stronger cyber incident response. Monitoring the latest developments with respect to the tactics and techniques used by threat actors to achieve their objectives, along with staying up-to-date with the long-term trends in motivations and targets, is crucial for an efficient defence in today’s cybersecurity ecosystem.

Moreover, understanding the trends related to threat actors, their motivations and their targets assist greatly in planning cybersecurity defences and mitigation strategies. It is an integral part of the overall threat assessment since it allows security controls to be prioritised and a dedicated strategy based on potential impact and the likelihood that threats will materialise to be devised. Having no understanding of threat actors and the way they operate creates a significant knowledge gap in cybersecurity, because one ends up looking and analysing threats without considering the motivations and goals behind those threats.

In this section, we explore the trends related to threat actors. This assessment does not provide an exhaustive list of all trends during the reporting period, but rather a high-level view of major trends observed at a strategic level. We focus on the threat actors’ motives, capabilities and targeting, and their evolution is assessed.

For the purposes of the ETL 2021, the following four categories of cybersecurity threat actors are considered:

 State-sponsored actors  Cybercrime actors  Hacker-for-hire actors  Hacktivists

The list of potential threat actors is evidently large and encompasses other categories such as insider actors, etc. The focus on the particular four categories above does not imply that other categories of threat actors are deemed of lesser significance. The reasoning behind the focus on the four selected threat actor categories is based on their relative prominence during the ETL 2021 reporting period.

2.1 STATE-SPONSORED ACTORS

COVID-19 drove cyber espionage tasking. During the reporting period, we observed state-backed groups conducting cyber espionage operations related to COVID-19 as well as using COVID-19 related lures for social engineering. Regarding COVID-19 related cyber-espionage, threat actors have been tasked to pursue information related to recovery and vaccine development efforts . According to publicly available reports, state-sponsored threat actors have been observed to be likely seeking data related to infection rates, country-level responses, and 15,16,17,18,19 treatments. Moreover, the collection of scientific information related to the COVID-19 vaccine was a highpriority requirement and thus the healthcare, pharmaceutical, and medical research sectors have been heavily 15,17,21 targeted.

ENISA THREAT LANDSCAPE 2021

Our assessment is that the targeting of the these sectors by state-sponsored actors will certainly continue as long as the pandemic lasts. In addition, we believe that the targeting of contact tracing systems as well as other COVID-19 related applications deployed by governments whose data can be valuable for intelligence gathering and spear phishing campaigns is likely. Finally, threat actors that have been ascribed as acting in the interests of nation states 17,20,21 exploited the concern and confusion related to COVID-19 with spear-phishing lures. In our opinion, cyber espionage groups will almost certainly continue to conduct (spear-) phishing attacks using COVID-19 themes.

Highly sophisticated and impactful supply chain compromises. While supply chain compromises by state-backed threat actors are not new, during the reporting period, this type of attack reached new levels of sophistication and 23,24 impact. One of the major campaigns that took place during the reporting period is the SolarWinds supply chain 23,25,26,27,28,29,30 compromise. The SolarWinds supply chain compromise is a prominent example of how great an impact a supply chain attack can have. The state-backed group behind this supply chain attack meticulously planned the attack making almost no operational security mistakes. Moreover, the threat actor showed exceptional knowledge of cloud environments, something that highlights the threats and current gaps in our knowledge of cloud 31,32 environments. The threat actor had well-defined and long-term espionage objectives judging from the careful selection of the targets and subsequent post-compromise activity compared to the circa 18.000 organisations that have been affected.

Based on ENISA’s analysis, on at least 17 occasions between 2020 and 2021, investigations confirm that supply

chain attacks were conducted by Advanced Persistent Threat (APT) groups, often state-sponsored, which constitutes more than 50% of the attributed supply chain attacks during this period. Moreover, software supply chain attacks are the most frequent type of supply chain attacks while the software services sector is the most targeted. From an attacker's perspective, the characteristics of the targeted software are usually the following: i) cross-network communication capability, ii) has root/admin-level privileges, iii) cross-platform/cross-operating system, iv) often whitelisted, and v) acts as a centralised management platform.

Historically, the majority of supply chain attacks resulted, or had the potential to result, in remote code execution. According to publicly available reports, various state actors have conducted software supply chain attacks. The most likely distribution vector of the supply chain attacks conducted by state-backed threat actors is via the hijacking of the software update process (others include the undermining of software certificates, open-source compromise, and mobile app store attacks). This distribution vector is very sophisticated and is indicative of the complexity and the careful planning and execution that is needed for such operations (e.g. see SolarWinds campaign timeline ).

Summing up, the diversified and complex world of supply chains offers a wealth of targets for state-backed threat actors. Moreover, the move to teleworking, exacerbated by COVID-19, led organisations to maintain or even increase the third-party suppliers they depend on for their operational needs. In our assessment, state-backed threat actors will certainly continue conducting supply chain attacks (especially targeting software, cloud, and managed service

ENISA THREAT LANDSCAPE 2021

providers) as they represent a unique initial access tactic. We also assess the likely targeting of cloud-hosted development environments as enablers for supply chain attacks. Finally, while many of these attacks were carried out by state-sponsored adversaries, cybercrime threat actors increasingly show the same patterns of behaviour.

State-backed groups and their operators engaging in revenue generation activities. As we have observed in the 37,38 past, there have been cases where state-sponsored adversaries have engaged in cybercrime operations. Moreover, during the reporting period, we identified cases indicating this is an increasing trend among various threat groups that are linked to nation states:

 We observed for the first time that the Lazarus group conducted targeted ransomware intrusions for financial gain. The likely motive behind these activities is monetary gain.  The US Department of Justice has issued indictments against individuals linked with the threat group APT41/WICKED PANDA for conducting cybercrime operations targeting the video game sector whilst also 40,41 conducting cyber espionage operations. The APT41’s cybercrime operations have been conducted for personal financial gain, e.g. obtain or generate video game currency via hacking to then sell it for profit.  The PIONEER KITTEN threat group has been identified with advertising and selling corporate network access on an underground forum. This activity has been likely conducted for personal gain.  Various threat groups (Labyrinth Chollima, Stardust Chollima, Velvet Chollima ) have been observed to deploy malicious cryptocurrency applications, targeting cryptocurrency exchanges, stealing cryptocurrency wallet credentials, and other currency generation operations. The likely motive behind these activities is monetary gain.  A member of the Sandworm threat group has been identified conducting spear-phishing campaigns against real estate companies, auto dealers, and cryptocurrency exchanges for personal gain .  According to the US Department of Justice, several Iran-based threat actors conducted both espionage and criminal operations . Regarding the actors’ money-making activities for personal gain (likely as a secondary income), they used the victims’ stolen information to steal financial information and they attempted to extort the victims after stealing sensitive information from them.  Cybercriminals allegedly acting on behalf of nation states have reportedly conducted cyber operations (ransomware attacks, cyber-enabled extortion, cryptojacking, and rank theft) for their personal gain .

It is our assessment that state-backed actors will certainly continue conducting revenue generating cyber intrusions (in pursuit of strategic objectives or for personal gain) with varying levels of national responsibility and thus further blur the lines between cyberespionage and cybercrime operations. As states leverage cybercrime groups to conduct cyber operations, we expect this trend to increase and these state-affiliated groups to engage in money-making intrusions for themselves.

Governmental organisations step up their game. During the reporting period, we observed increased efforts from governments to disrupt, “name and shame”, and take legal action against state-sponsored threat actors. We have

ENISA THREAT LANDSCAPE 2021

observed (among others) several indictments issued and sanctions imposed by the US Department of Justice,

public attribution statements from the NCSC-UK, a public statement by the White House, a joint advisory from

NSA-FBI-CISA, and the Norwegian government’s public statement. From the EU perspective, we have observed

the first-ever sanctions announced by the European Council against state-sponsored threat actors, a statement

related to cyberattacks that have been undertaken from the territory of China, and the new EU Cybersecurity Strategy that strengthens the EU Cyber Diplomacy Toolbox to prevent, discourage, deter and respond to cyberattacks

against the EU. Moreover, aligned with the US Cyber Strategy of “persistent engagement”, we have observed USbased agencies (e.g. US Cyber Command, CISA, NSA) publicly disclosing Tactics, Techniques and Procedures (TTPs), campaigns, and tools of state-backed threat actors thus disrupting their operations and “burning” their toolsets. Finally, we observed the FBI obtaining court approval to remove web shells from Internet-connected and

compromised Microsoft Exchange servers in the US.

The goal of the activities described above is to disrupt the operations of adversaries, enable network defenders to detect and respond to malicious activities, act as a means of signalling to adversaries (potentially deterring them or

influencing their behaviour), and establish a level of cyber norms in cyberspace. We assess that it is likely that more

countries will start using indictments, public disclosures and attribution statements as part of their cyber strategy. On the flip side, it is still not yet clear how these activities will deter highly sophisticated and determined state-backed threat actors in the long term. The hacking of the e-mail accounts of the most prominent federal prosecutors in the US Department of Justice during the SolarWinds campaign suggests, though, that indictments against foreign cyber

operators can have a deterrent effect .

Hindering defenders’ efforts. During the past few years, we have observed threat actors monitoring threat intelligence reporting and attribution disclosures and responses from an operational and strategic perspective. Over the years, one can claim that state-backed threat actors have been learning from their past mistakes and they have

been improving their operational security and leaving no high fidelity indicators during their intrusions .

ENISA THREAT LANDSCAPE 2021

An increasing number of state-sponsored threat actors have been observed to use offensive security tools (OSTs) 63 64 65 (especially Cobalt Strike but also Empire, Metasploit , Mimikatz, etc.), living-off-the-land techniques, and published proof-of-concept code. These options provide them scalability of operations, ease of use, deniability, operational effectiveness, and reduced costs. State actors utilise such tools and techniques (at least) in the early phases of their intrusions and before deploying their home-grown tools to reach their objectives. Moreover, the leveraging of cybercriminal contract hackers by states (for deniability) as well as the wide use of common tools and techniques by cybercrime and state-backed actors undermine credible attribution.

Finally, the use of false flags can be regarded as an established method related to state-backed threat actors. 69 70 During the reporting period, we observed the cases of MontysThree and DeathStalker threat actors that utilised false flags.

In our assessment state-backed groups will certainly be leveraging offensive security tools, living-off-the-land techniques, published PoCs, false flags, criminal contract hackers, crimeware-as-a-service, and will also be exhibiting high levels of operational security to conduct cyber operations. All these will further complicate the detection, response, and especially the defenders’ attribution efforts.

Increased targeting of ICS networks. Historically, organisations have had less visibility in their ICS networks as compared to their IT networks. Moreover, digital transformation initiatives, the rise of Industrial IoT, the cloud connectivity of ICS devices, as well as the remote access services for ICS networks provide opportunities for the threat actors (For example, the abuse of valid accounts was the No1 technique used by threat groups targeting ICS networks ).

During the last 5-10 years, adversaries have increasingly invested resources to target ICS networks. According to publicly available reports, the number of threat groups targeting ICS networks is growing at a rate three times faster than they are going dormant and, during the reporting period, at least four new groups were discovered: STIBNITE, TALONITE, KAMACITE, and VANADINITE. The objectives of these groups vary from information collection and long-term persistence to disruption of ICS operations and potential physical destruction.

In our assessment the interest in targeting ICS networks will certainly grow in the near future. While we previously discussed the opportunities for ICS targeting, the drivers for such operations include the desire for technological independence, geopolitics (e.g. conflicts, long-term persistence, cyber warfare), as well as testing the capabilities of threat actors and preparing for future attacks (some threat actors are still learning about ICS domain, experimenting and developing ICS-targeting capabilities).

ENISA THREAT LANDSCAPE 2021

Cyber operations are driven by state strategies, geopolitical tensions, and armed conflicts. It is common knowledge, nowadays, that cyber operations are conducted by most states all over the world to accomplish their strategic objectives. Thus, states are striving to develop, buy or hire cyber offensive capabilities to place themselves in a favourable position in this cyber arms race. The implementation of such cyber capabilities is important for their national strategies and their long-term planning. Currently, some of the trends we observe are that a) states with advanced cyber capabilities are using them to strategically shape global political, military, economic, and ideological power, b) middle powers are focusing on initiatives related to regulation, cyber norms, and protection of their critical infrastructure, and c) low-capability cyber powers are enhancing their defensive and offensive postures.

During the reporting period, we observed that cyber operations were aligned with the strategic objectives of states as well as with the geopolitical landscape and real-world events. Notably, we observed increased cyber intrusion 78 79,80,81 activities in regions of trade routes (e.g. between Europe and Asia ), in regions of armed conflict, against strategic targets such as governmental organisations (e.g. SolarWinds supply chain attack), and cyber operations as enablers for large-scale espionage, personally identifiable information and the theft of intellectual property (e.g. the Microsoft Exchange hack ).

State-sponsored groups are increasingly testing and exhibiting their capabilities for disruptive operations. In our assessment state-backed actors will certainly continue pursuing their strategic objectives via cyber operations for intelligence gathering for advantages in decision-making, stealing intellectual property, and pre-positioning of military and critical infrastructure (preparation of the operational environment) for future conflicts. It is also our assessment that state-backed groups will possibly develop (or buy or otherwise procure) and conduct disruptive/destructive operations masqueraded as ransomware to weaken, demoralise and discredit adversarial governments. Finally, local conflicts will likely include cyber operations paired with drone attacks and media-driven misinformation in order to amplify impact.

Information operations as a tool to pursue states’ strategic goals. Information operations dominated the news headlines during the 2016 US elections. Currently, several states are leveraging information operations as a tool for hybrid conflicts exploiting societal divisions, undermining trust, and polarising societies over issues that are sensitive and important in certain countries.

During the last few years, we observed an evolution in how threat actors are conducting information operations. First, we observed threat actors conducting more targeted information operations as compared to the “noisy” ones in the pas.t Moreover, currently there are commercial actors that sell Information-Operations-as-a-Service, providing plausible deniability for their sponsors. Threat actors have also adapted their TTPs and exhibit better operational security as well as platform diversification to survive takedowns .

ENISA THREAT LANDSCAPE 2021

During the reporting period, major topics of information operations included election interference and COVID-19.

During the 2020 US elections and the 2021 pre-election period in Germany, there were reported cases of information operations as preparatory work for such operations. According to publicly available reports, intelligence

services have been conducting information operations related to COVID-19 issues. The EUvsDisinfo is a European task force that tracks disinformation threats and has 922 COVID-19 disinformation narratives in its database (as of

31st July 2021). These narratives vary from promoting conspiracy theories about the origin of COVID-19, through vaccine rollout and disinformation about vaccination strategies, the handling of public health measures, undermining

public trust in the European Medicines Agency (EMA), and to fuelling anti-vaccination movements in the EU.

Our assessment is that threat actors will very likely continue pursuing their strategic objectives by conducting cyberenabled information operations for the next decade focusing on important geopolitical issues like elections, public

health, humanitarian crises, human rights, and security. Also, in our opinion, threat actors will very likely continue leveraging the latest technology (e.g. Artificial Intelligence, deep fakes, voice biometrics) to impersonate individuals as

part of their information operations. Finally, in our view, it is possible that there will be increased leveraging of

Information-Operations-as-a-Service together with increased competition of these disinformation networks.

Hack-and-leak operations are an established tactic. Hack-and-leak operations include activities where a threat actor has unlawfully accessed information via a cyberattack and then leaks this information. This information is usually leaked in a specific context ̶ sometimes the information is manipulated ̶ and at a time that serves the threat actor’s

objectives to achieve the desired effect and influence public debate. Targets for these operations can be businesses, politicians, as well as governmental organisations, and they are information operations impacting the

confidentiality and integrity of the information leaked.

Hack-and-leak operations are not a new tactic but they gained traction after the hack-and-leak operations during the

2016 US elections. For these operations, their impact, perpetrators (mostly using fake identities), and targets are hard to predict. However, if the stolen information is not sold on underground forums (showing a financial motivation by the threat actor) but rather shared with the public, one can assess that these operations likely have a political

motivation. Threat actors conducting hack-and-leak operations usually fall within the category of state actors, hacktivists, or front entities acting on behalf of nation-backed groups such as hacktivists. The latter is also a trend that has been identified in recent years as state-backed groups are increasingly using hacktivists as cover under which to conduct their operations; they even co-ordinate with hacktivists so that these operations look like the work of genuine

hacktivists .

ENISA THREAT LANDSCAPE 2021

During the reporting period, the European Medicines Agency (EMA) fell victim to a cyberattack. The stolen information 100,101 was made public through the Internet and was picked up by the media. Based on the EMA’s investigation, not all the leaked documents were in their original form and this data manipulation could spread doubt about admission procedures and the safety of COVD-19 vaccines. Another interesting case was the operation conducted by the Ghostwriter threat group that targeted members of the German Parliament and Polish government officials (among 102,103,104,105 others). According to publicly available reports, documents from the personal e-mail accounts of government officials were leaked on Telegram while the operation against German MPs was likely to be preparatory work for a future hack-and-leak information (especially taking into account that 2021 is an election year in 106107 Germany).

In our assessment hack-and-leak operations by state-backed and state-affiliated groups will very likely continue in the near future, as these operations require low to medium resource investment by the threat actors compared to their potential impact. Moreover, we expect these operations to intensify during periods of high interest (e.g. pre-election periods) and exploit political divisions or instability. Moreover, our assessment is that threat actors will likely conduct these operations through a series of releases so that they can sustain news media attention. The latter highlights the importance of the target’s response towards the leak operation in order to direct the media narrative more to the hack element rather than the leak element of the adversary’s operation.

2.2 CYBERCRIMINALS

COVID-19 created opportunities for cybercriminals. Social engineering remains the most prevalent attack technique. The effectiveness of a phishing campaign depends on whether it taps into strong emotions that drive action from the recipient’s side. During the pandemic, cybercriminals have been exploiting people’s interest, concern, curiosity, and fear by using phishing lures related to COVID-19 for financial gain. The COVID-19 lure themes matched the different stages of the pandemic. The major ones used by the cybercriminals have reportedly 112,113 been the following:

 Exploitation of individuals looking for details on disease tracking, testing, and treatment;  Impersonation of medical bodies, including the World Health Organisation (WHO) and US Centre for Disease Control and Prevention;  Financial assistance and government stimulus packages;  Tailored attacks against employees working from home;  Scams offering personal protective equipment;  Passing mention of COVID-19 with previously used phishing lure content (e.g. deliveries, invoices, and purchase orders);  Vaccination-related lures;  Phishing lures related to new variants of COVID-19.

ENISA THREAT LANDSCAPE 2021

Cybercriminals have also been observed selling tailored COVID-19 related phishing kits in underground forums as well as spoofing domains designed for harvesting credentials and personal data e.g. as stimulus packages were announced. When COVID-19 vaccine travel certificates were introduced by governments all around the world, cybercriminals were observed selling fakes ones on the dark web.

We also observed cybercriminals, in their pursuit of money, spreading fake news about COVID-19 via digital advertisements and websites related to potential COVID-19 cures and other COVID-19 prevention measures. The goal of these fraud schemes was to trick people into buying fake medicines and other goods related to COVID-19.

COVID-19 also created opportunities for targeted ransomware attacks since the potential disruption of organisations within the healthcare and public health sector will have multiple impacts during the pandemic. The top ransomware families that targeted the healthcare and public health sector were Maze, Conti, Netwalker, and Ryuk and we observed the focused targeting of small and medium-sised hospitals and clinics.

Our assessment is that COVID-19 cybercriminal activities will continue and will adapt to emerging COVID-19 topics 118,119 and regional phases of the pandemic. It is also our considered view that the healthcare and public health sector will certainly continue to be heavily targeted by ransomware groups as long as the pandemic lasts. Finally, in our opinion the targeting of COVID-19 related applications deployed by governments, whose data can be valuable and be made available for sale in underground markets and phishing campaigns, is likely.

The exploitation of Work-From-Home technologies. During the pandemic, organisations were forced to change their strategies and quickly adopt technologies that would support the new reality of remote working. This allowed cybercrime adversaries to take advantage of the rapid deployment of these teleworking technologies and exploit them for initial access. Technologies that have been heavily targeted by cybercrime actors are network appliances and 122 123124 125 remote access services (especially Virtual Private Network , Citrix and RDP services ). The exploitation of such technologies involved old, unpatched and newly discovered vulnerabilities as well as initial access via compromised credentials.

In our view cybercrime threat actors will certainly continue targeting technologies that support teleworking and specifically VPN and remote access services. The organisation will be relying on these services as long as the pandemic lasts and their successful compromise by the adversaries gives the latter the opportunity of remote access to their victims without even deploying any malware. Another interesting point is that the potential return to the office may leave these teleworking services orphaned and this will provide additional opportunities for adversaries. All these highlight the importance of fundamentals such as patch and vulnerability management as well as the security hardening of these systems and applications.

ENISA THREAT LANDSCAPE 2021

Cybercriminals go where money is (…to targeted ransomware). During the reporting period, the frequency and

the complexity of ransomware attacks increased (by more than 150% in 2020 ) and became one of the greatest threats that organisations face today regardless of the sector to which they belong. We are observing the golden era

of ransomware ̶ it has become a national security priority ̶ and some argue that it has not yet reached the peak of

its impact. Ransomware attacks are such a big issue that the OFAC (Office of Foreign Assets Control) issued an

advisory to instruct organisations about the risks of potential sanctions for facilitating ransomware payments.

It has been observed that cybercriminals are less likely to target payment-related data (e.g. credit cards) and more

likely to target any data that will have an impact on the victims' operations. The successful business model of human-operated ransomware (aka Big Game Hunting) has been increasingly attracting cyber-criminal threat actors

and it is also having an impact on their targeting. An indicative example is the FIN11 threat group whose observed target has changed due to the likely shift of its operations from point-of-sale (POS) campaigns to targeted

ransomware.

Moreover, the Ransomware-as-a-Service (RaaS) business model is blooming. During 2020, two-thirds of

ransomware campaigns were attributed to operators using RaaS. This trend sets a relatively low barrier for

conducting this type of cybercrime and allows inexperienced cybercriminals to conduct ransomware attacks.

Taking into account the increasing number of publicly reported ransom payments, the success of the RaaS business

model, and the active recruitment of new members for the ransomware groups on Dark Web forums. Our assessment is that more cybercriminals will very likely be attracted to shifting their targeting to focus on targeted

ransomware operations and replicate these successes.

Multiple extortion methods. During the reporting period, the tactics that ransomware groups use to put pressure on their victims and force them to pay the ransom have evolved. In late 2019, the Maze group demonstrated double

extortion tactics : a) the systems and data of an organisation are encrypted and a ransom is requested, and b) the organisation’s sensitive data are exfiltrated and Maze operators threaten to publish the exfiltrated data on “public shaming websites” as extra leverage to demand further ransom payments.

During the reporting period, we have observed further evolutions in the tactics used by ransomware groups:

 Monetisation of the stolen information through data auctions in the dark web;

 Media amplification of their victim’s compromise by contacting journalists;

 Cold calling victims if they begin the ransomware recovery process without paying the ransom;

ENISA THREAT LANDSCAPE 2021

 Reaching out to business partners, investors, board members and other stakeholders disclosing information about the attack;  Conducting DDoS attacks against the victim in order to add more pressure to pay the ransom;  Reaching out to victim’s customers and clients to action and demand a ransom payment;  Calling and harassing employees;  Turning to revenge porn as an extortion tactic.

In the past, ransomware groups have been opportunistically targeting mostly small and medium-sised enterprises with security programs that are not very mature but currently we have observed a strong focus on targeting bigger organisations that could potentially pay higher ransoms. The evolution and escalation of cybercriminals’ extortion tactics are aligned with increased pressure to pay the ransom needed on these bigger organisations. Our assessment is that the extortion methods of cybercriminals will certainly evolve further so they keep succeeding in getting higher ransom payments from their victims.

Increasing collaboration and professionalisation. During the reporting period, we observed cybercrime groups that have developed specialised cybercrime services, and cybercriminals that have built relationships within the ecosystem as well as affiliate models.

The cybercrime ecosystem has a global presence. In this ecosystem, we observed different actors providing and specialising in different services. This “Cybercrime-as-a-Service” trend lowers the barriers for threat actors that want to conduct cybercrimes while it enhances the reach of cyberattacks. The different types of services offered in the cybercrime ecosystem include:

 Main types of services: access brokers, phishing kits, credit/debit card testing services, malware packing services, web inject kits, hardware for sale, ransomware, loaders, (bulletproof) hosting and infrastructure, DDoS attack tools, anonymity and encryption, crime-as-a-service, counter antivirus service/checkers, recruiting for criminal groups;  Distribution services: social network and instant messaging spam, exploit kit development, spam e-mail distribution, purchasing traffic and/or traffic distribution systems (TDS);  Monetisation services: money mule and cashing services, reshipping fraud networks, dump shops, collection and sale of payment card information, money laundering, ransom payments and extortion, wire fraud cryptocurrency services.

Many of the cybercrime groups in this ecosystem provide services that support targeted ransomware operations, but access brokers play an increasingly critical role. We have observed cybercriminal groups that had historically been 154 155 operating banking trojans (e.g. Trickbot, Qakbot ) capitalise on their access to compromised organisations by selling it (mostly to ransomware groups and operators). According to publicly available reports, there are at least 10 threat actors that act as access facilitators (or are ransomware affiliates) and sell their access to multiple ransomware operators . While there is not a 1:1 relationship between these access-enabling malwares and ransomware attacks there was a unique relationship between Emotet (malware distribution), Ryuk (ransomware), and Trickbot

ENISA THREAT LANDSCAPE 2021

(backdoor) that suggests that the groups behind these different approaches to attack are either part of a larger criminal organisation or they increasingly collaborate and depend on each other .

We have also observed cybercrime groups that have developed affiliate programs where they exclusively sell the malware to the affiliates and share the money paid. Finally, we have observed ransomware groups creating cartels to enhance collaboration, share tactics and help each other publish their victims’ data on their “public shaming sites”.

Our assessment is that botnet operators will very likely capitalise on their infections by selling access to other cybercriminals. It is also our opinion that access brokers and the threat actors behind them will very likely increase in sophistication and demand, while some of them are likely to abandon cybercrime forums and use private channels. Finally, state-backed threat actors will likely be buying initial access to organisations of interest from access brokers .

Managed service providers as high-value targets for cybercriminals. Nowadays, we observe that organisations are increasingly outsourcing their IT infrastructure management and are depending on other companies for various digital services. Managed service providers are high-value targets for cybercriminals since their compromise enables them to target their clients as well.

The compromise of a service provider introduces the following potential risks for its clients;

 Confidentiality risks related to the clients’ data as they can be exfiltrated and stolen;  Availability risks related to the continuity of the service provider’s business, with a subsequent impact on its

clients;  Risks related to the potential propagation of an infection from the service provider to its clients;  Risks related to the misuse of clients’ service accounts for further malicious activities.

According to the ENISA Threat Landscape on Supply Chain , attacks against managed service providers are increasing but it is still unclear whether the scope of the attackers was also to target their clients in all cases. Within the reporting period, some of the most prominent cybercriminal activities against service providers include the cases 163 164 165 166 of Blackbaud, SendGrid, AG and Kaseya.

The cyberattack against Kaseya by the REvil ransomware group was one of the major cyberattacks observed during the reporting period. Kaseya is a vendor that provides Kaseya VSA software that is widely used by Managed Service Providers to manage IT infrastructure. The impact of this supply chain attack was huge; 50 Managed Service Providers (MSPs) had been using Kaseya’s VSA software which was compromised while 800-1500 businesses that were managed by the compromised MSPs were infected with the ransomware. Moreover, about one

ENISA THREAT LANDSCAPE 2021

million computers were affected by this ransomware attack and REvil operators have requested 50 million dollars for a universal decryptor. It is interesting to note that the threat group demanded ransom payments only from the end businesses that were impacted and not from the compromised MSPs. While MSPs have been (indirectly) targeted by supply chain attacks, the fact that they could deploy software (ransomware in this case) to their clients (this is part of the daily tasks of IT infrastructure management) amplified the effect of this attack.

Our assessment is that cybercriminal actors will certainly continue targeting (directly or indirectly via their suppliers)

managed service providers as a way to target the clients of MSPs, especially with respect to ransomware attacks.

Cybercriminals transitioning to the cloud. The pandemic fastened the adoption of cloud infrastructure and services by organisations globally and the “moving to the cloud” trend is expected to continue for the foreseeable future. However, apart from the apparent benefits of migrating to the cloud, there are also associated risks for

organisations. The rapid deployment of cloud infrastructure and services due to the urgent needs of the teleworking

workforce during the pandemic as well as the gap in cloud-specific expertise resulted in poorly secured and managed cloud deployments that provide opportunities for cybercriminals. According to publicly available reports,

misconfigured cloud deployments were a leading cause of breaches while external cloud systems were more

common than on-premises assets in data breaches.

Cybercriminals (as well as state-back actors) have already identified these opportunities and developed capabilities to breach cloud infrastructure and services. During the reporting period, we observed cybercriminals enumerating cloud

environments, deploying the first cryptomining worm to steal AWS credentials, cryptomining on Linux servers in

the cloud, and targeting Docker and Kubernetes environments. Moreover, there is an increasing trend of

cloud providers being compromised by ransomware groups such as BlackBaud, Swiss Cloud, Equinix, and

Cloudstar. . Finally, credential-based attacks against cloud services that are poorly secured or have not enabled

Multi-Factor Authentication (MFA) proliferate.

Our assessment is that attacks against cloud environments will almost certainly continue and will likely have a greater impact as more organisations adopt and implement Cloud-First strategies. Cloud downtimes will likely cause enough pressure (due to SLAs as well as a lack of tested recovery processes and cloud expertise) to coerce companies into paying ransoms in cases where they have been victims of ransomware attacks (even if they have backups in some

cases) .

ENISA THREAT LANDSCAPE 2021

Cybercrime attacks increasingly target and impact critical infrastructure. During the reporting period, we observed increased targeting of critical infrastructure by cybercrime actors. Major critical infrastructure sectors being impacted are the healthcare, transportation, and energy sectors.

Ransomware attacks have disrupted the operations of public health agencies, hospitals, and emergency services. Threat actors have been specifically targeting the healthcare and public health sector despite the promises of some

ransomware gangs to stop doing so during the pandemic. They grasped this opportunity during the pandemic since

this sector became extremely significant and highly susceptible. Ryuk is a ransomware gang that heavily targeted

the healthcare sector in the USA despite the attempts cybersecurity vendors to take them down.

According to publicly available reports, the transportation industry has faced cybercrime threats related to initial

access offerings, gift card fraud, and ransomware. All four major shipping companies have fallen victim to

ransomware attacks during recent years while the trucking sector has experienced high-profile ransomware

attacks. Because the Courier, Express, and Parcel (CEP) business is blooming it could be regarded as critical

infrastructure during the pandemic. Thus it attracted the attention of cybercriminals who targeted the CEP sector. Finally, despite limited flights and air traffic during the pandemic, the aviation industry faced disproportional numbers

of cyberattacks.

The ransomware attack against Colonial Pipeline (a US fuel company) by the Darkside ransomware group had a high impact as a perceived gas shortage led to stockpiling and panic (although the IT network was impacted, operators

stopped ICS operations for protection). Colonial Pipeline’s ransomware attack also drove policy initiatives within

the US with Joe Biden signing an Executive Order to strengthen cybersecurity and restarting the discussion on the

responsibility of states for cybercrime attacks. Regarding the targeting of ICS networks, there has been an

increase in public and non-public ransomware events affecting ICS environments. Ransomware families like

EKANS, Megacortex and Clop have already developed ICS-aware functionality to stop industrial processes.

It is our opinion that, as our society becomes increasingly dependent on technology and Internet connectivity, cybercrime attacks against critical infrastructure are very likely to become more disruptive. It is also likely that

ENISA THREAT LANDSCAPE 2021

disruptive attacks against critical infrastructure may masquerade as ransomware attacks while having different 198 204 objectives.

Dark web markets contribute to and follow the actors’ business models. During the reporting period, we observed a general trend that applies to many of actors, predominantly to the cybercriminals given the financial implications. The dark web has become even more connected with the threat actors during the reporting period. In previous years we observed the growth of both the flow of cryptocurrencies and the anonymising of networks. These two key developments helped the dark wed become even more accessible due to the anonymisation it provided.

Marketplaces have given the ability to threat actors to procure services and capabilities that they lack, and to promptly gain access to breached data. Through the markets and underground forums threat actors that lack certain skills, for example to develop a custom ransomware, are able to identify RaaS providers and procure the necessary skillset. The providers offer to the customers various services (trading, payment and recovery). In exchange for these tools and services the providers receive a small portion of the ransoms . A recent report also showed the average price listings of the most common requested services. We have also seen cases in which the threat actors launched recruitment campaigns via the dark wed (Revil).

In conclusion, the revenue of dark web markets hit a record during the reporting period at a total of 1.7 billion dollars’ worth in cryptocurrency, even though this was mainly to the growth of Hydra. This is a prime indicator that the dark wed has become an integrated part in the ecosystem of the threat actors.

2.3 HACKER-FOR-HIRE ACTORS

Rise of hacker-for-hire services. This category of threat actors refers to actors within the “Access-as-a-Service” (AaaS) market that is mostly comprised of firms that offer offensive cyber capabilities. Their clients are usually governments (but also corporations and individuals) and the service categories they offer are (usually bundled altogether as a single service): Vulnerability Research and Exploitation, Malware Payload Development, Technical Command and Control, Operational Management, and Training and Support.

The hacker-for-hire companies operate legally in their country of operation and the market as a whole is currently semi-regulated. The clients of these companies pay them mostly to conduct cyber espionage operations, get access to advanced offensive cyber capabilities and enjoy plausible deniability. These hacker-for-hire threat actors complicate the threat landscape and introduce the following challenges for defenders:

 Their targeting cannot be predicted as it depends on the tasks their clients order; there is no focus on specific sectors and thus any sector has the potential to be targeted.  These threat actors act as proxies and it is very difficult for defenders to identify their sponsors as well as their objectives.

ENISA THREAT LANDSCAPE 2021

During the reporting period, the major hacker-for-hire actor under discussion was the NSO Group and a leak that was related to the targeting of activists, journalists, and political leaders. The impact of this leak is evidenced by several 214 215 proposals across the globe on managing such a threat.

We also observed the alleged hacker-for-hire group called DeathStalker that has been targeting organisations within the Financial and Legal services sectors for corporate espionage. While the group’s TTPs are evolving (e.g. use of

false flags ), its operations are representative of the fact that these threat actors can accomplish their goals without using highly sophisticated tools.

Some groups have focused on cyber espionage activities in specific regions e.g. Bahamut targeted entities in the Middle East and South Asia, CostaRico mostly focused on targets in South Asia, etc. Thus, we observed some regional targeting from some hacker-for-hire groups, which is likely due to their country of operations as well as their client base.

Our assessment is that hacker-for-hire companies will certainly continue targeting any sector based on their sponsors’ requirements. While the operations of hacker-for-hire companies are disclosed from time to time, our assessment is that these companies will certainly complicate defenders’ efforts in identifying their original clients. Finally, in our opinion, the hacker-for-hire industry will likely experience increased state control and oversight (and potentially more 220 213 attention from cybersecurity companies) due to potential national security risks as well as human rights abuse .

2.4 HACKTIVISTS

Hacktivists’ operations remain low in numbers, sophistication, and impact. After 2016, we observed a falloff in hacktivism following its peak during the period 2010-2015. Nowadays, hacktivists act mostly in small groups of individuals, protesting against regional events and targeting specific organisations. Their targets remain their traditional ones: financial institutions and governmental agencies. Massive public participation is missing. This is likely due to the prosecution of various hacktivists in recent years which has acted as a deterrent.

Regarding hacktivists’ capabilities, their tactics remain “old school” mostly focusing on DDoS attacks, defacements, releasing of sensitive data, and account takeovers. During the reporting period, the frequency of hacktivists’ operations was low and did not have the impact they had in the past. This is something that can be attributed to the limited sophistication of their operations and their limited resources as well as the improved security controls that their target organisations have developed over the years.

It was expected that there would be a rise in hacktivism during the pandemic as more people were staying at home 223,224 and this would increase the potential for participating in online protests (and disruptions). However, this

ENISA THREAT LANDSCAPE 2021

development did not materialise since hacktivism operations lacked technical capacity at scale and extensive public participation. Moreover, the content moderation policies of some sharing platforms reduced the impact of some of the activists’ operations. Thus, the low hacktivism activity observed during the reporting period was mostly focused on regional events. During the reporting period, some of the most notable hacktivist activities were:

 Verkada hack – A group of hackers gained unauthorised access to 150,000 video archives of security cameras by taking over accounts. The hackers claimed responsibility for the attack and their motivation was to highlight the dangers of mass video surveillance as well as the insufficiency of security controls for securing these video recordings. A Swiss hacker, who claimed hacktivism motives, was arrested and charged for this cyberattack.  Black Lives Matter – During the summer of 2020, the hacktivist group Anonymous re-emerged during the protests related to the death of George Floyd . The group focused on DDoS attacks against the Minneapolis police department website as well as releasing e-mail addresses and credentials allegedly taken from police servers (but it is likely their source was old data breaches ).  BlueLeaks hack – BlueLeaks was probably the most prominent hacktivist operation conducted during the reporting period. This anonymous hacktivist group leaked more than 1 million documents stolen from a Texas firm called Netsential that provided web-hosting services to several US law enforcement agencies. The leaks were distributed via the DDoSecrets platform whose Twitter account was later suspended for policy violations related to the distribution of hacked data.

Our assessment is that the threat posed by hacktivists will very likely remain low in the near future. Our opinion is based on the number, sophistication, and impact of the hacktivists’ operations during the reporting period. The focus of hacktivists’ activity will remain regional although new movements are gaining traction (e.g. environmental and antidiscrimination) that are likely to develop hacktivism side-tactics and attract wider public participation for online protest (and disruption). Finally, It is our opinion that state-backed groups will almost certainly continue to leverage hacktivism as a disguise to achieve their strategic goals.

ENISA THREAT LANDSCAPE 2021 ENISA THREAT LANDSCAPE 2021

3. RANSOMWARE

Ransomware is a type of malicious attack where attackers encrypt an organisation’s data and demand payment to restore access. In some instances, attackers may also steal an organisation’s information and demand additional payment in return for not disclosing the information to authorities, competitors, or the public.

Compromise through phishing e-mails and brute-forcing on Remote Desktop Protocol (RDP) services remain the two most common infection vectors. During the reporting period in 2021, we saw that the Conti and REvil threat actors dominated the ransomware market from a financial as well as from a volume of infections point of view. Both actors provide separate ransomware-as-a-service (RaaS) platforms through which affiliates can efficiently orchestrate their attacks. The focus on RaaS-type business models increased during 2021, making proper attribution to individual threat actors difficult.

The occurrence of multiple extortion schemes also increased strongly during 2021. After initially stealing and encrypting sensitive data from organisations and threatening to release it publicly unless a payment is made, attackers also target the organisations’ customers and/or partners for ransom to maximise their profits.

Cryptocurrency remains the most common pay-out method for threat actors. Attackers shifted to Monero as their cryptocurrency of choice because of its enhanced anonymity and the indistinguishability of transactions.

The average ransom amount doubled over the last year, though small amounts of ransom are still popular with threat actors. They tend to be paid more easily and result in less public exposure for the threat actor. The higher demands also increased. Over just a few months, the highest demand made in 2020 more than doubled in 2021.

Some large ransomware operations shut down, whether voluntary or due to actions carried out by law-enforcement agencies. However, groups have shut down in the past, only to resurface under another operation.

Several ransomware attacks were reported during the ETL reporting period. Figure 5 shows the incidents observed based on OSINT (Open Source Intelligence) collected by ENISA for the purposes of situational awareness. The scope of the collection is global and multi-sectorial. Incidents, however, with a direct impact in the EU area are given priority. We have observed a steady increase in ransomware incidents being reported since 2020, and a sharp increase in May and June 2021. A list of notable ransomware incidents can be found in Annex B.

Figure 5: Ransomware incidents observed by ENISA (April 2020-July 2021)

ENISA THREAT LANDSCAPE 2021 3.1 TRENDS 3.1.1 Conti and REvil ransomware groups lead the market

Based on crowdsourced ransomware payment data (as illustrated in Figure 6), the ransomware groups with the most financial gains in 2021 are Conti ($12.7 million), REvil/Sodinokibi ($12 Million), DarkSide ($4.6 Million), MountLocker ($4.2 Million), Blackmatter ($4.0 Million) and Egregor ($3.1 Million).

Figure 6: Ransomware data, grouped by family, in 2021. (Source: https://ransomwhe.re/)

When looking at statistics based on trends in responses to ransomware incidents, the ransomware groups with the most market share in 2021 Q1 are REvil/Sodinokibi (14.2%), Conti V2 (10.2%), Lockbit (7.5%), Clop (7.1%), and Egregor (5.3%). For 2021 Q2 the top is represented by Sodinokibi (16.5%), Conti V2 (4.4%), Avaddon (5.4%), Mespinoza (4.9%) and Hello Kitty (4.5%). These last two are newly emerging ransomware variants.

Both from a financial and an incident perspective, we see that Conti and REvil dominated the ransomware market in 2021. We expect to see no infections from the original REvil/Sodinokibi and Darkside groups in the coming months, as these have shut down at the time of writing this report. We also waiting to see whether the arrest of Clop members, involved in money laundering, will impact the rest of their operations.

3.1.2 RDP and phishing remain the most common attack vectors

Initial compromise through RDP has been the major attack vector for the last few years. However, since 2020, we see that this attack vector is in decline. In contrast, attacks through phishing e-mails rose during 2020. In Q2 2020, we see both vectors as the most used ways to gain an initial foothold. Note that these two vectors are also the cheapest and thus most profitable methods for threat actors.

Compromise through RDP is mostly achieved by brute-forcing credentials. The advantage of this method is that threat actors enter the network using legitimate credentials, allowing them to stay unnoticed. Although organisations with a higher security maturity will monitor this type of activity, most medium to small businesses will not. Brute-forcing RDP credentials is possible due to weak credentials, lack of two-factor authentication or a secure tunnel (VPN) to access the RDP. Compromise of the RDP service itself due to a vulnerability happens but is less common.

ENISA THREAT LANDSCAPE 2021 3.1.3 Ransomware-as-a-Service business model

The use of Ransomware-as-a-Service (RaaS) platforms during attacks has become the norm. This type of service offers a platform for other threat actors, groups, and individuals and is based on an affiliate model. The platform facilitates all the elements needed to cover a ransomware attack, from file encryption and storage to payment.

The RaaS provider takes a cut on the ransom payments received from the victim, while the affiliate stays in control of the bounty and the communication towards the victim. The platform makes all the tools needed for easy deployment on the compromised target, and these tools are under continuous development. Like a healthy business, the RaaS platforms are continuously adapting to changes in the environment in order to stay undetected by endpoint and network security tools. RaaS has made ransomware attacks available to any malicious actor, even when they lack technical knowledge.

3.1.4 Recruiting future insider threats

An upcoming trend in more elaborate ransomware attacks is the active recruitment of employees to assist during the ransomware campaign. In August 2020, a Russian national was convicted for actively targeting and recruiting an employee at Tesla. The employee needed to execute malware on his company’s computer system, which would exfiltrate data from the company’s network. He would then threaten to disclose the data online unless the company paid a ransom demand. The employee would receive $1,000,000 in bitcoins after the malware was installed. Lockbit also promises the gain of ‘millions’ in its insider recruitment program.

3.1.5 Profit maximisation: a shift from double to multiple extortion

Throughout 2020, double extortion was a common theme during ransomware attacks. This type of attack combines the traditional encryption of files on the victim’s network and systems, as well as the exfiltration of it. The extracted data is then hosted and held hostage on a leak or dump-site owned by the ransomware group. These are also referred to as shame sites. While negotiations are ongoing, the files often remained locked. Some RaaS platforms include the feature of a timer to indicate the time a victim has left to resolve the payment or negotiate the ransom. Research showed that in Q3 2020, almost half of all ransomware incidents featured the threat of data release.

Traditional ransomware attacks would only cripple the organisations’ internal operations. By threatening to release the data, victims are not only pressured to meet the group’s ransom demand but also by the threat to disclose the breach to their customers and partners. In previous ransomware incidents, this notification was often neglected due to fear of impacting business and public relations. Due to the public shaming aspect of breaches due to double extortion ransomware, companies are in a way incentivised to openly communicate about an incident. The threat to leak exfiltrated data has increased significantly, from 8.7% in 2020 to 81% in 2021 Q2.

We see the requirement to report breaches to law enforcement agencies becoming an important theme for cybersecurity lawmakers. An interview with a supposed member of the Lockbit ransomware group mentions that threat actors are aware of this. They predict that payments can become more difficult for United States-based victims. Supposedly, Europeans pay immediately out of fear for GDPR fines.

In 2021, we see another evolution in the maximisation of profit: the emergence of the multiple extortion scheme. After initially stealing and encrypting sensitive data from organisations and threatening to release it publicly unless a payment is made, attackers now also target the organisations’ customers and/or partners for ransom. In April 2021, REvil targeted Quanta Computer, a notebook manufacturer. When the company refused to pay any ransom, the attackers turned their attention to Apple, and threatened to release blueprints they stole through the initial attack. The

ENISA THREAT LANDSCAPE 2021

campaign towards Apple was dropped and Apple did not officially comment on the incident. The same tactic was seen used by the Clop ransomware gang in May 2021. After targeting RaceTrac Petroleum and threatening to release the companies’ files, the actor moved forward to contact their customers and partners directly and threaten to release their files. Note that some research describes the use of DDoS as the triple extortion vector, and the ransom towards the victim’s client then becomes the quadruple extortion. However, a DDoS attack is only used to increase the pressure but adds no actual ransom or extortion to the process, as the company is already locked out at that time. Through a ransomware breach, third parties themselves become exposed. Like a regular company, the ransomware actors are constantly on the lookout for more business opportunities. These third-party victims are ideal vectors to request new ransoms or even start new ransomware campaigns using the internal information that was previously obtained.

3.1.6 Cryptocurrency for ransom payment: a shift from Bitcoin to Monero

For a few years now, cryptocurrencies like Bitcoins have been preferred by cyber threat actors to receive ransom payments. The promise of a fast, secure, and anonymous channel to move the money made it a perfect solution. The transparent and decentralised structure makes it a reliable channel and protects the money. In addition, due to the higher computer power necessary to generate new hashes, and stricter regulations, the value of bitcoin has dramatically increased over the last two years. While the wallet can offer anonymity, it is not untraceable. Due to the transparency of bitcoin transactions and the wallets associated with specific ransomware groups, it becomes possible to research the affiliation between groups and follow the payments being made. This data gives an insight to estimate the actual financial gains of threat actor groups more reliably.

In May 2021, Colonial Pipeline fell victim to a ransomware attack orchestrated by ransomware group DarkSide. The FBI was involved after the victim had already paid the ransom demand of around 75 bitcoins. By reviewing the Bitcoin public ledger, law enforcement could track multiple bitcoin transfers and identify that the group had transferred approximately 63.7 bitcoins to a specific wallet address. It turns out that the FBI had the “private key” needed to access assets from the specific Bitcoin address. With a seizure warrant, the FBI proceeded to seise the coins. It was not disclosed how the FBI obtained the private key. This operation was a success and the first time law enforcement retrieved the larger part of a ransom in cryptocurrency.

After the seizure, a shift was noticed towards the use of Monero as cryptocurrency. Monero was launched as an opensource project to add anonymity and indistinguishability of transactions but quickly gained traction among users and has had stable growth over the last few years. Ransomware group REvil only accepted Monero in 2021. Other groups such as DarkSide and Babuk left the choice to the victim but added charges when choosing bitcoin to pay the ransom.

While not all are originating from cybercrime, the US Internal Revenue Service (IRS) has seised $1.2 billion worth of cryptocurrency in 2021 alone. Typically, seised wallets are auctioned publicly. In addition, crowdsourced projects give easy visibility to these payments and the malware families.

ENISA THREAT LANDSCAPE 2021 3.1.7 Money laundering is the weak spot

At some point, threat actors want to convert their ransom from cryptocurrency to money. At that point, maintaining anonymity over the wallet becomes more challenging. Major cryptocurrency exchanges require proof of identity to keep a record of payments, which makes it difficult for threat actors to cash out their gains easily. This is where money laundering schemes come into play.

Researchers used interviews and the investigation of police files to investigate ransomware groups’ modus operandi to launder their profits. Based on the results, two main models were identified; based on the payment of the ransom 1) via vouchers and 2) via bitcoins. In the crypto-based model, bitcoins are first sent through a mixer, a mechanism that groups crypto from different sources together and divides it back via random transactions, in time and value, to other destination wallets. This mixer makes it more difficult to track where and how the original transaction moves. Bitcoins are then either exchanged via 1) a bitcoin exchange for money, 2) a (human) bitcoin trader in exchange for physical money, 3) money laundering services, or 4) used directly as bitcoins.

Ransomware groups are much more intertwined than was assumed. A large concentration is seen at the deposit address level, where only 199 addresses received 80% of all funds sent by ransomware addresses in 2020. An even smaller group of 25 addresses accounts for 46%. The key takeaway is that only the owners of a small pool of addresses support and control the ability to cash out ransomware gains. This concentration is also the weakness of the ransomware groups. Successful operations against the owners of these addresses could impact their gains and ability to pay all people involved in the ransomware scheme.

The Nemty ransomware group shut down its operations in April 2020. Researchers discovered internal details of their operations between 2019 and 2020. The interesting part is that the list of affiliates was disclosed. Through the list, some well-known nicknames are found. These users can be found all over the place, showing that the affiliates of RaaS are not working exclusively with one provider. This overlap in users suggests that the core RaaS actors are a small group of people, which is consistent with the previous section regarding the concentration of deposit addresses.

When ransomware groups are investigated, those involved in money laundering have more chances of getting caught. Transferring cryptocurrency to money is a process where true anonymity is hard to maintain. It was the case for the Clop ransomware group. Six people were arrested and charged with laundering $500 Million for the gang.

The laundering schemes used are expected to further develop over the years. Only through proper international coordination of law-enforcement, but also cooperation with the private sector, e.g. exchanges markets, will we stand a chance to properly investigate money trails, to disrupt the ransomware operations.

ENISA THREAT LANDSCAPE 2021

3.1.7.1 The average ransom doubled in 2020

Figure 7: Average ransom, based on data from Coveware

A study suggests that in 2019, the average ransom paid was around $80,000. In 2020, this more than doubled to an average of $170,000. According to the same study, the average in 2021 Q1 and Q2 was around $180.000. Other research finds that the average ransom increased from $115,123 in 2019 to $312,493 in 2020. Both of these findings show the same trend. For the first half of 2021, we can conclude that the average amount peaked further. These figures support the idea that small ransom amounts are still worthwhile for threat actors while also easier for companies to defend paying.

3.1.8 Highest ransom demands are skyrocketing

Another trend is an increase in the ransom demanded by threat actors. This amount is often the starting point for the ransom to be paid. If companies want to pay, negotiations are held and, usually, only a part of the initial sum is paid. The highest ransomware demand grew from $15 million in 2019 to $30 million in 2020. Since this research, REvil has stepped up its game, demanding $50 million from Acer in March 2021. A month later, in April, the ransomware group requested the same amount from Quanta Computer, a supplier to Apple. In July 2021, after Kaseya got hit, they demanded a $70 million ransom to publish the universal decryptor to unlock every device affected. Over just a few months, the highest demand of 2020 more than doubled in 2021. It is likely we will hit the cap of a $100 million ransom demand in 2022.

With record-high demands, we also see record-high pay-outs. The incidents that are publicly disclosed or that receive media attention are only the tip of the iceberg. There are other public ransomware incidents with high ransoms, where the actual amount discussed during negotiation leaked, but payment of the ransom was never confirmed, such as 263 264 Garmin in 2020 ($10 million) and CNA in 2021 ($40 million). As long as organisations keep paying, there is no reason for ransomware groups to lower their demands. The highest pay-outs become a goal or even a reference for existing and future ransomware groups.

ENISA THREAT LANDSCAPE 2021 3.1.9 Overall increase in costs and revenue loss due to ransomware

When a ransomware incident happens, organisations are confronted with a lot of cost. These costs include the amount of ransom, downtime, and the cost of people and actual operational and technical remediation, etc. A survey conducted across 30 countries showed that the overall cost of remediating a ransomware attack has vastly increased, from $761,106 in 2020 to $1.85 million in 2021. The results suggest that the overall cost of a ransomware incident more than doubled in only one year.

During a ransomware attack, key infrastructure is often targeted to paralyse the organisation, causing the inability to provide proper service and run internal operations. The average downtime of organisations has increased over the last year. Research shows that the average downtime increased from 15 days in Q1 2020 to 23 days in Q2 2021.

Aside from the costs related to the incident, repercussions on business opportunities and revenues have also been observed. A survey of 1,263 respondents reported that 66% of their organisations suffered significant revenue losses due to ransomware attacks, where company sise appears to have minimal impact on revenue loss. The results underline the fact that every industry vertical is vulnerable to a statistically significant chance of revenue loss following successful ransomware.

3.1.10 The volatility of ransomware groups; shutdowns and arrests

Whether voluntary or based on actions from law-enforcement agencies, we saw large ransomware operations going offline. In the past, groups have shut down, only to resurface under another name.

In November 2020, the Maze ransomware group announced the end of its operations. Maze published data referring to more than 300 successful ransomware operations. It is believed that the group behind Maze will eventually reform as the Egregor group.

In January 2021, a Canadian national was charged in relation to NetWalker ransomware attacks in which tens of millions of dollars were allegedly obtained.

By the end of January 2021, the FonixCrypter or Fonix Ransomware group announced the shutdown of their operation and released the master decryption key. While not confirmed, there are some indications that the group were arrested.

The threat actors behind Ziggy ransomware shut down their operation one week later, also releasing the decryption keys. They sent out a message about feeling guilty for their actions. Research on their ransomware sample showed Gaza, Iran, Syria, Lebanon, and Palestine as white-listed countries. Note that white-listing specific countries is a common practice in malware.

In February 2021, three people from the Egregor ransomware group were arrested in Ukraine following a joint operation between French and Ukrainian law enforcement. Egregor operated a Ransomware-as-a-Service (RaaS) business for affiliates and had around 200 public victims. Because of Egregor’s rapid growth and successful

ENISA THREAT LANDSCAPE 2021

operations, victims even had to wait in a queue to negotiate a ransomware payment. Blockchain analysis suggested affiliate overlap and other possible connections between Maze, Egregor, SunCrypt, and Doppelpaymer.

In April 2021, the group behind Babuk ransomware announced the shutdown of their operations quickly after their successful attack against the District of Columbia’s Metropolitan Police Department. After analysing their decryptor, researchers stated that it caused significant damage due to faulty code, leading to unreliable and sometimes faulty decryption, destroying the files in the process.

In May 2021, the DarkSide ransomware group, which also operated with a RaaS model, announced the group’s shutdown closely after the attack on Colonial Pipeline. After the attack, the group initially announced they would ‘vet’ the targets of their affiliates and explained that their motives were not political or destructive. Another announcement was later made that they would cease their operations and send out decryptors to all the victims. The statement, posted in the Russian language, claimed that an unspecified law enforcement agency disrupted part of its infrastructure. It is still uncertain whether this information was factual or part of an exit strategy for the group. Note that the decryptor used by DarkSide was also not well designed, and the decryption process ran too slow for efficient recovery of their victims’ operations. Therefore, even after paying for the decryptor, they had to resort to their own backups to help restore the system.

In June 2021, a Latvian national faced charges stemming from her alleged role in a transnational cybercrime organisation responsible for creating and deploying a computer banking trojan and ransomware suite of malware known as Trickbot.

Later in June, six members from the Clop ransomware group were detained in Ukraine after a joint operation between Ukraine, South Korea, and the United States. While the authorities claimed to have shut down the group’s infrastructure successfully, the ransomware operation is still in business and is listing new victims on their data leak site. The operations targeted the money-laundering side of the operation, while the platform core members were not apprehended.

In July 2021, Avaddon, a ransomware group operating a RaaS platform, announced the shutdown of their operation. Along with the announcement, they released 2,934 decryption keys, one for each of their victims. This number of decryption keys shows that the number of reported ransomware infections is just the tip of the iceberg.

Later in July, REvil/Sodinokibi shut down its operations. Note that this is just days after the communication between the United States and Russia regarding the increase in ransomware attacks. High-profile victims of the group were Kaseya and its many managed service provider (MSP) customers and JBS Foods.

New groups have mysteriously emerged while these others shut down. Backmatter, for example, is a group that is actively recruiting affiliates or ‘initial access brokers’. However, encryption algorithms found in a decryptor show that the group is, in fact, a rebrand of the DarkSide ransomware operation. Grief, another new group, is a rebrand of

ENISA THREAT LANDSCAPE 2021

What this indicates is that these shutdown operations are often nothing more than rebranding operations. The goal is not always clear, whether to fool or distract law enforcement agencies and researchers or to deal with unhappy affiliates. The fact remains that all these groups share common malware writers, overlapping source code, and affiliates that use the platform. Over time, they will all disappear and re-emerge in one way or another. Overall, we see law enforcement actions taking place, but the impact on the operations of these groups remains limited.

3.1.11 Increased usage of zero-day vulnerabilities

In the past, zero-days were only used for targeted attacks by advanced threat actor groups and nation-states. The reason is, of course, the cost (value) of such a zero-day. Threat actors can only re-use it as long as the attack vector and payload are not discovered. Therefore, threat actors will carefully select the target and consider what it is potentially worth, and whether and when to ‘burn’ an exploit.

In December 2020, Accellion patched a zero-day vulnerability in its legacy File Transfer Appliance product. The vulnerability turned out to be one in a cascade of vulnerabilities. Four zero-days (CVE-2021-27101, CVE-2021- 289 290 291 27102, CVE-2021-27103, CVE-2021-27104 ) were used to extract the data of its customers. The victims then received extortion e-mails from an actor claiming association with the Clop ransomware team gang. Technically speaking, no ransomware was deployed, but the actors threatened to expose the stolen data if no ransom was paid.

After the initial publication of a zero-day vulnerability, we generally see an increase in attacks, where threat actors try to target as many unpatched victims as possible. In June 2021, The PrintNightmare vulnerability (CVE-2021-1675 ) was initially discovered. Magniber ransomware was observed quickly adapting and weaponising the PrintNightmare vulnerability to target victims, mainly in South Korea.

With the increase in ransoms, we see more zero-days being used to gain a foothold in an organisation and execute a ransomware attack. It shows that the potential revenue of a ransomware attack is higher than the cost of the exploit. Especially in operations at scale, this makes a lot of sense. The decrease in the number of attacks and the focus on large organisations allows for threat actors to ask for high ransoms. This focus on a high pay-out is referred to as big game hunting (BGH). Instead of targeting a large pool of targets using prevalent malware distribution vectors such as phishing, victims are carefully studied, and sophisticated methods are used to breach these high-value targets. The focus and potential of BGH dominated the ecosystem of cybercrime in 2020 and boosted the market for network access brokers. This way, BGH trends disrupted traditional targeted cybercrime behaviour.

ENISA THREAT LANDSCAPE 2021 3.1.12 Insurance fuels the ransomware industry economy

With the general increase in cybersecurity incidents, organisations are more prone to take out cybersecurity insurance. Taking out insurance is part of a risk strategy in which you transfer the risk to a third party. Being insured doesn’t mean that the security risks are mitigated. Instead, the risk of associated costs in case of an incident is reduced. Companies faced with ransomware incidents will more readily pay, knowing that they have insurance coverage. Research points out that ransomware coverage in insurance policies is not only encouraging threat actors, but the practice may be fuelling the entire ransomware economy. The insurance industry is facing criticism over this. The largest insurance organisation in the United States defends ransom payment reimbursements. One of Europe’s top five insurers announced in May 2021 it would suspend ransomware crime reimbursement. Note that this suspension only covered France.

Ransomware coverage in cybersecurity insurance becomes unsustainable as the ransoms will only increase in value and numbers. A survey showed that in 2020, 26% of the victims paid the ransom to get their data back. This number rose to 32% for 2021. More victims are thus paying their ransom. This rise will impact insurance companies and the cost of an insurance policy. An insurer with 25.000 small and midsise customers in North America reported that in 2020, 41% of their customer claims were related to ransomware attacks.

Insurance companies can play an important role by requiring their customers to improve their IT security. However, insurance companies often only impose basic risk assessments, including security tests, to validate whether a baseline is covered within the organisation. A common requirement is to do vulnerability scanning against the external perimeter of the organisation’s IT infrastructure. While this is certainly a good initiative, it results in a narrow representation of the company’s security posture and the associated risk. However, an article suggests that ransomware-related claims dropped by 65% following the insurance’s security scans. As previously discussed, RDP exposure on the external infrastructure has been a preferred way for intrusion for a long time and could explain why scanning for remote services on the external perimeter does reduce the likelihood of ransomware incidents.

3.2 RECOMMENDATIONS

The following proposed recommendations provide the basis for the development of a mitigation strategy for the prevention of and response against ransomware.

 Implementation of secure and redundant backup strategies;  Implementation and auditing of identity and access management (least-privilege and separation of duties);  Training and raising the awareness of users (including privileged users);  Separation of development and production environments;  Information sharing on incidents with authorities and the industry;  Restricting access to known ransomware sites;  Identities and credentials should be issued, managed, verified, revoked, and audited for authorised devices, users, and processes;  Access permissions and authorisations should be managed, incorporating the principles of least privilege and separation of duties;  Separation of development and production environments;  Ransomware response and recovery plans should be tested periodically to ensure that risk and response assumptions and processes are current with respect to the evolving ransomware threats;  Use of security products or services that block access to known ransomware sites;

ENISA THREAT LANDSCAPE 2021

 Execution of the Ransomware Readiness Assessment (RRA), a tool developed by CISA geared towards IT and ICS (industrial control system) networks, to evaluate their security against varying levels of ransomware threat readiness;  Report any attack or attempted attack to the authorities and help restrict its spread;  Systems’ monitoring for fast identification of infections; and  Keeping up with recent ransomware trends, developments and proposals for prevention.

ENISA THREAT LANDSCAPE 2021 ENISA THREAT LANDSCAPE 2021

4. MALWARE

Malware is an umbrella term that describes any software, firmware or code intended to perform a malicious unauthorised process that will have an adverse impact on the confidentiality, integrity, or availability of a system. Examples of malware could be a virus, worm, Trojan horse, or other code-based entities that infect a host. Spyware and some forms of adware are also part of the malware term.

A malware can have various and different capabilities depending on the goal of the creator. For example RATs (Remote Access Trojans/Tools) are malware that allow an actor remote control of an infected system. Infostealers or Skimmers are designed to capture credit card information. Botnets are a robot network of computers infected by malware and controlled by C&C servers. Trojans, which can be either a banking Trojan or a mobile Trojan depending on the target, are malware that are often disguised as legitimate software.

The threat of malware appears consistently in the ETL, with new families and strains emerging every year despite the laudable efforts of law enforcement to take them down. In the following paragraphs, we describe general trends that emerged during the reporting period. A list of notable malware incidents can be found in Annex B. In addition, it needs to be emphasised’ clarified that mitigation vectors are generic in nature and security professionals need to look for specific mitigation vectors for different malware families.

4.1 TRENDS 4.1.1 Decline of 2020 continues over 2021

Malware attacks decreased heavily during the reporting period. Research has shown that attacks in North America decreased by 43% in 2020 compared to 2019. This drop was almost same in Europe, while a decrease of 53% was noticed in Asia. One of the key factors for this reduction could be linked to the COVID19 pandemic. Employees worked more from home and used their consumer ISPs and personal computers for work-related activities. This home environment and infrastructure doesn’t have the same level of protection and detection, limiting the visibility of malware infections. The reduction in this visibility can cause a gap when collected statistical data is based only on detecting infections in the corporate environment.

In 2021, the decrease in malware infections is continuing. Research shows a further reduction of 22% over the first six months of 2021, compared to this period last year. Note that a reduction in total malware volume does not mean that cybercrime declined. In the past, malware was used to infect a maximum of victims. Today, the focus is less on quantity and more on the quality of infections. In 2019, the number of malicious Office and PDF files was equal. Throughout 2020, the number of malicious Office files increased heavily until they exceeded PDF files by 150%. In 2021, the share of malware on both these file types dropped, with executable files gaining the ground they had lost.

For 2020, the most detected malware categories in corporate environments included botnets (28%), cryptominers (21%), infostealers (16%), mobile (15%), banking (14%), and ransomware (4%). In June 2021, the most common malware families detected were Trickbot (botnet and banking), XMRig (cryptominer), Formbook (infostealer), Glupteba (botnet), and Agent Tesla (infostealer). Notice that these malware families did not change a lot over the last year. One noticeable difference is the fact that Emotet was taken down and Trickbot took over its market share .

ENISA THREAT LANDSCAPE 2021 4.1.2 Windows container malware

Malware targeting container environments has become much more prevalent. The technology of containerisation allows scaling easily. Malware focusing on the cloud-native stack, is in essence, not new. In November 2020, malicious container images had been already identified, and were used to find and exploit vulnerabilities on a particular victim’s Kubernetes environment. In December 2020, researchers also discovered the existence of file-less malware being executed from memory. Common defence mechanisms or static scanners would not detect this type of infection. In March 2021, researchers uncovered the first known malware that targets Windows containers. Other typical initial infection vectors include misconfigured container dashboards, APIs or daemons, or security issues in the application hosted on the container environment.

The most common goal of this type of malware is to escape the container, to infect the whole cluster. Clusters are generally collections of multiple applications, which increases the impact of such an infection heavily.

Common compromises include the leakage of sensitive information such as passwords, credit card numbers etc. In addition, container technology is often used as a best practice during the development lifecycle to spin up separate environments quickly. Compromise of development environments could result in further supply-chain attacks. Attackers stay under the radar and build in backdoors through source-code commits. The modified software is spread and used as an infection vector, targeting the software’s users through genuine installers or the software’s update functionality.

Patch management for container infrastructure is often disregarded because of the short lifespan of container instances. However, the discovered attacks underline the importance of protecting all exposed infrastructure. Automated tools execute attacks in a short time, enough to steal files or escape to the cluster. Once the cluster is owned, all data and code should be considered compromised.

4.1.3 Mobile Malware

In 2020, fake ad blockers, also referred to as adware, were on the rise on Android. This type of malicious application tempts the user with “add blocking” capabilities, asks for extensive permissions on the operating system, and starts using all sorts of notifications and browser redirects to present ads and thus generate revenue. A close variant is the hiddenAds mobile malware. In 2020, detection of this malware type increased from 280.000 to 700.000 compared to 2019. The large proportion of adware in mobile malware continues throughout 2021. 45% Of mobile malware was identified as adware in the first half of 2021. Installation of these applications usually happens through third-party app stores as well as in online forums.

Mobile banking malware saw an increase in 2020. The malware tries to steal online banking credentials and payment information by showing fake login screens. The malware is then capable of performing transactions on accounts with financial institutions. The most common malicious banking applications in 2021 include Ghimob, Eventbot, and Thiefbot. Other common malware is Blackrock, Wroba, and TrickMO.

In May 2021, Flubot infections increased using SMS as a spreading mechanism. The increase was mainly noticed in Europe and the UK. In most messages, either government (COVID-19 related) or package delivery brands were impersonated to lure victims into installing a malicious application.

Most malware is based on malicious applications that users install. In 2020 and 2021, there have been some cases of significant vulnerabilities in popular applications allowing remote code execution, but malicious applications were not reported to target these actively. There have been cases of zero-day vulnerabilities targeting the mobile platform instead of an application. However, the victims of these attacks are very specific and high profile. The Pegasus spyware for iOS is used worldwide to target journalists, activists, and politicians. The malware uses two zero-click malware variants: the

ENISA THREAT LANDSCAPE 2021

Kismet exploit in 2020 and the Forcedentry (Megalodon) in 2021. In July 2021, a list of 50.000 victims of these targeted attacks leaked.

4.1.4 Detection is bypassed using exotic languages

Malware developers resort to relatively new or uncommon programming languages. While not entirely new, this trend has continued to evolve throughout 2020 and 2021. These uncommon languages include but are not limited to Rust, Nim, DLang, and Go . The main motive is to bypass detection capabilities.

As most of the detection capability of malware is based on static indicators, these become irrelevant or ineffective when the source code is rewritten in a new language. From a reverse engineering perspective, it also becomes more challenging to analyse these new malware samples. Either entire rulesets must be rewritten to match patterns in the newly written malware, or focus needs to be shifted to the detection of dynamic or behaviour-based signatures. An example of this trend was reported in May 2021, when the original Buer malware was shown to have been rewritten in Rust, named RustyBuer. Their similarity is based on nearly identical communication structures between the commandand-control servers and the infected host.

Malware written in these emerging programming languages only represents a fraction of all the malware being developed today. Still, it is an important aspect for the future development of malware detection and code analysis techniques. Migrating to other languages could mean that the scanners and defenders of today lose effectiveness and ability to detect the malware of tomorrow.

4.1.5 Malware disruption

Emotet is a strain of computer malware. Initially, the malware acted as a banking trojan. Over the years, the malware evolved and gained more ground. The functionality shifted from a simple information stealer to malware used to create an advanced botnet. The malware featured a well-developed command and control (C2) infrastructure, frequent updates and was very effective in evading detection.

In 2020, the malware used Trickbot and QBot to steal credentials and spread inside networks. Throughout 2020, Emotet had been the most prevalent malware. The victims, part of the botnet, were often sold to other threat actors for targeted cyber-crime, such as ransomware or information stealing.

In January 2021, Interpol announced a crackdown on the botnet. Law enforcement and judicial authorities worldwide cooperated and took control of the botnet’s infrastructure in a coordinated international action. Through the C2 infrastructure, they delivered ‘updates’ to the malware, which would cause it to uninstall itself in April 2021. The Ukrainian government arrested two individuals in relation to this investigation.

The fight against cyber-crime is an ongoing and uneven battle. However, this case shows that through international cooperation, law enforcement can have an impact.

4.1.6 High-Risk Vulnerabilities Across Major Vendors increase in 2021

At the end of 2020 and on into 2021 a wide spread of products were affected by high-risk vulnerabilities. Critical, easily exploited vulnerabilities appeared in multiple products from vendors such as Microsoft, Apple, Google, Adobe, Dell, SonicWall, QNAP, and VMWare. Another example is the vulnerabilities found in Apple software which were also increasingly exploited in 2021. Attackers, such as the Silver Sparrow malware, have been targeting Apple products.

ENISA THREAT LANDSCAPE 2021

This malware is the second known piece of macOS malware to feature a program compiled for the new M1 chip that Apple introduced in November 2020.

In many cases these vulnerabilities had already been exploited by the time they were disclosed. Accellion and the vulnerabilities affecting Microsoft Exchange in Q1 2021 were among the most prominent.

4.1.7 Malware as a business

Malware as a service is not a new trend. The move from static exploit kits to cloud-based rental models were discovered in the past. We will not focus here on Ransomware-As-A-Service (RaaS), as this is covered in the previous chapter.

4.2 RECOMMENDATIONS

During the reporting period several good practices and mitigation vectors concerning malware were noted, as follows:

 Implement malware detection for all inbound/outbound channels, including e-mail, network, web and application systems in all applicable platforms (i.e. servers, network infrastructure, personal computers and mobile devices).  Inspect the SSL/TLS traffic allowing the firewall to decrypt what is being transmitted to and from websites, email communications, and mobile applications.  Establish interfaces between malware detection functions (intelligence-led threat hunting) and security incident management to establish efficient response capabilities.  Use the tools available for malware analysis for sharing malware information and malware mitigation (i.e. MISP).  Develop security policies that specify the processes to be followed in the event of infection.  Understand the capabilities of various security tools and develop new security solutions. Identify gaps and apply the defence-in-depth principle.  Employ mail filtering (or spam filtering) for malicious e-mails and remove executable attachments.  Regularly monitor the results of antivirus tests.  Use patch management for container infrastructure.  Make use of log monitoring using security incident and event management (SIEM) solutions. Indicative log sources are anti-virus alerts, endpoint detection and response (EDR), proxy server logs, Windows Event and Sysmon logs, intrusion detection system (IDS) logs, etc.  Disable or reduce access to PowerShell functions.

ENISA THREAT LANDSCAPE 2021 ENISA THREAT LANDSCAPE 2021

5. CRYPTOJACKING

Cryptojacking or hidden cryptomining is a type of cybercrime where a criminal secretly uses a victim’s computing power to generate cryptocurrency. This usually occurs when the victim unwittingly installs a program with malicious scripts that allow the cybercriminal to access their computer or other Internet-connected devices, e.g. by clicking on an unknown link in an e-mail or visiting an infected website. Programs called ‘coin miners’ are then used by the criminal to create or ‘mine’ cryptocurrencies.

During the reporting period we saw a growing trend in cryptojacking, which could perhaps be associated with the increasing volatility in the cryptocurrency market that was observed during the same period. Moreover, given that cryptocurrencies offer (pseudo) anonymity, they become a very attractive and convenient means of exchange by cybercriminals. Accordingly, it should be noted that cryptocurrencies in general are requested when asking for ransom in ransomware attacks. A list of notable cryptojaking incidents can be found in Annex B.

5.1 TRENDS 5.1.1 Cryptojacking volume in 2021 is record high

Since 2019, we have witnessed a steady decline in drive-by cryptominers, the dominant type for the past few years . The decline, which is aligned to the diminishing value of drive-by mining profitability, was hastened by the shutdown of 333 334 Coinhive in March 2019 and JSECoin in April 2020, as described in last year’s ETL report. However, attackers have moved on to other types of malicious activities when it comes to cryptojacking/cryptomining, with Cisco reporting that 69% of its customers had been affected by cryptomining malware in 2020. According to the same report, cryptomining generated the most DNS traffic out of any other malicious activity.

In March of 2020, a spike in infections was seen, after which the infection rate dropped dramatically. From the second to the last quarter of 2020, the volume of infections increased slowly and this continued in 2021. In the first quarter of 2021, the volume of infections attained a record high compared to the last few years. Other statistics confirm this trend, showing that during the first quarter of 2021, cryptomining malware increased by 117%. This last report links this increase to the growth in 64-bit mining applications. We can conclude that financial gain associated with cryptojacking incentivised the associated threat actors to carry out these attacks. Based on the fluctuating value of cryptocurrency, we assume this will remain an important attack vector over the coming year.

When comparing the exchange rate of Bitcoin with the volume of cryptominers, we clearly see how both are related. As mentioned in the ETL 2021 Ransomware report, threat actors are shifting from Bitcoin, which provides pseudoanonymity, to using strongly private cryptocurrency such as Monero. Europol reports that cryptocurrencies continue to facilitate payments for various forms of cybercrime, as developments evolve with respect to privacy oriented crypto coins and services.

ENISA THREAT LANDSCAPE 2021 5.1.2 XMRig dominates the cryptomining market

In 2020, the global market of cryptomining malware was dominated by XMRig (35%), JSECoin (27%), Lucifer (7%), WannaMine (6%), RubyMiner (5%), and others (20%). JSECoin was an open-source miner that shut down its services in April 2020 due to financial uncertainties after the COVID-19 pandemic.

XMRig , an open-source miner, is used by attackers and most malware to perform cryptomining on victims unwillingly. Over the first half of 2021, its market share increased to 51%, accounting for more than half of all cryptomining malware. Other infections are related to Lucifer (10%), LemonDuck (5%), RubyMiner (5%), Wannamine (5%), and other miners (20%). First discovered in May 2020, the Lucifer malware can, amongst other things, execute DDoS attacks, exploit vulnerable Windows hosts, and perform brute-force attacks. These features allowed the malware to propagate itself rapidly. Under the hood, the malware drops XMRig to mine. The LemonDuck malware strain is already a few years old and is gaining more ground in 2021. It is also a self-propagating cryptominer, dropping XMRig on the victim to perform mining tasks. Since April 2021, the malware has been targeting unpatched Microsoft Exchange Servers, suffering back then from multiple zero-days. Microsoft reported that cryptominers were some of the first payloads to target these vulnerabilities actively, illustrating how well these could adapt to use make of new exploits.

Even though Wannemine and RubyMine are older XMRig dropping malware variants, they still retain a foothold in 2021. Wannamine further limits its malicious activity on the infected host, focusing solely on the mining.

5.1.3 Shift from browser to file-based cryptojacking

Research showed that for the first trimester of 2021, desktop or file-based cryptojackers were almost seven times more frequent than browser-based miners, at 13% for browser-based compared to 87% for file-based.

Other research confirms that since the shutdown of Coinhive, the share of browser-based cryptomining dropped. This gap is filled by file-based crypto-jackers, which first compromise the victim’s host and then drop mining software on it. In general, cryptojacking accounted for a mere 2.5% of malware used in breaches and only 1.5% of malware in incidents. Around 10% of organisations received (and blocked) cryptocurrency mining malware at some point throughout the course of the year .

5.1.4 Infection methods do not change

The techniques used to spread and deploy cryptominers do not differ much from other malware infection methods. A drive-by download is a technique used to deliver and install malicious files on a victim’s device without its knowledge. This happens passively when visiting malicious websites, triggering a download that takes advantage of the operating system or the web browser, which contain security flaws. Notice that compromised websites are also used as a delivery vector for cryptominers. Another distribution method is malvertising, the act of spreading malware through advertisements.

Cryptominers are often delivered as applications that hide their malicious behaviour. Typical examples are mobile applications. While these applications are subject to automated security validation before being published on the application store, these detections are not always adequate. Alternative stores are also used to spread malicious mobile applications.

ENISA THREAT LANDSCAPE 2021

There are also deceptive mobile applications claiming to do cryptomining, but their only functionality is to lure users into expensive subscriptions. Another example is malicious browser add-ons, which leverage JavaScript libraries. These are distributed through official browser add-on stores and forums.

Cryptomining software like XMRig is often incorporated in other malware and exploit kits. Advanced malware can exploit other machines with known vulnerabilities or, through brute-forcing, can migrate over different machines and act like a cryptomining worm.

Interestingly, cryptojacking malware is also reported to actively search and terminate other cryptomining instances running on their victim’s host. The Kinsing cloud crypto-jacker is such an example. The Linux-based malware installs a Monero miner and then ensures maximum system resources by killing other processes and even docker containers that are resource-intensive.

5.1.5 Cryptomining targeting cloud and container infrastructure

Cloud infrastructure allows processing power to be scaled up when needed. When cloud hosts are infected by cryptojacking malware, the costs can become monumental. The cloud providers bill for the consumed CPU cycles, while the gains resulting from the computing operations only cover a fraction of the costs.

Container infrastructure is also an interesting target, as these environments will spawn worker nodes based on needs. Cryptojacking was already seen on Kubernetes in the past but the entry vectors were either vulnerable web applications or malicious containers already containing mining malware. In June 2020, a large-scale campaign targeted Kubeflow, a machine learning toolkit, aiming to infect internet-facing Kubernetes instances and use them for cryptomining at the victims’ expense. After gaining access to the cluster, they deployed a malicious container to run their XMRig-based miner.

5.1.6 Disruption of illegal cryptomining operations

In May 2021, in the United Kingdom, law enforcement terminated a cryptomining operation, and the equipment was confiscated based on a charge of the theft of electricity. The bust happened in the context of a search warrant for a suspected cannabis farm.

Later in May, China decided to ban financial institutions and payment companies from providing services related to cryptocurrency transactions. The initial ban targeted three provinces, which according to research, accounted together for more than 65% of Bitcoin’s hash rate.

On the first of July, the security services of Ukraine (SBU) shut down a mining operation running on stolen electricity. The services acted on the threat to the region's critical infrastructure. On the eighth of July, the SBU shut down a cryptomining operation and seized almost 5,000 computers. The seizure included 3800 game consoles and 500 graphic cards. The suspects were charged with the theft of electricity. The monthly loss was estimated to be up to USD 250.000.

ENISA THREAT LANDSCAPE 2021

In July 2021, the Malaysian authorities reported having seised more than 1,000 bitcoin mining devices and arrested six persons on charges of theft of electricity over the course of six separate raids. They destroyed the devices and put the images on YouTube, sending a message to other mining operators.

We see an increase in law enforcement operations against (illegal) cryptomining. The cost of energy associated with bitcoins pushes these mine operations to steal electricity. This practice is not new, as it has been used by farms that cultivate drugs. Disruptions in these operations will make the actors move to other locations and other means to mine crypto, such as leveraging infrastructure from compromised devices.

5.2 RECOMMENDATIONS

The following mitigation vectors were mentioned regarding cryptomining related attacks and incidents in the reported period.

 Monitor battery usage on users’ devices and, in the case of suspicious spikes in CPU usage, scan for the presence of file-based miners.  Implement web filtering of common cryptomining protocols, as well as blacklisting the IP addresses and domains of popular cryptomining IP pools.  Monitor for network anomalies and block mining protocols.  Install endpoint protection by means of anti-virus programs or crypto-miner blocking browser plug-ins.  Conduct regular security audits to detect network anomalies.  Implement robust vulnerability and patch management to protect against emerging threats and vulnerabilities.  Implement patches and fixes against well-known exploits.  Use whitelisting to prevent unknown executables from being executed at the endpoints.  Use allow-listing to allow only the execution of known executables on the endpoints.  Monitor and block common cryptomining executables.  Invest in raising users’ awareness of cryptojacking, especially with regard to secure browsing behaviour.  Discuss crypto mining in the context of security awareness training.

ENISA THREAT LANDSCAPE 2021 ENISA THREAT LANDSCAPE 2021

6. E-MAIL RELATED THREATS

E-mail related threats have been consistently ranking high in the list of prime threats in the ETL for a number of years. This collection of threats exploits weaknesses in human behaviour concerning e-mails and human habits, and aims at manipulating humans to fall victims to an attack. E-mail related threats are in general less about the technical vulnerabilities of information systems, but mostly about end-user awareness and exploitation of the inherent trust people place on their e-mail communications. This threat canvas consists mainly of the following vectors: phishing, spear-phishing, whaling, smishing, vishing, business e-mail compromise (BEC) and spam.

Phishing aims at stealing important information like credit card numbers and passwords, through e-mails involving social engineering and deception. Spear-phishing is a more sophisticated version of phishing that targets specific organisations or individuals. Whaling is a spear-phishing attack aimed at users in high positions (executives, politicians etc.). Smishing, a term derived as a combination of "SMS" and "phishing”, occurs when financial or personal information of victims are gathered via the use of SMS messages. Another type of threat related to e-mail is vishing, a combination of phishing and voice that occurs when information is given via phone, where malicious actors using social engineering techniques extract sensitive information from users.

Business e-mail compromise (BEC) is a sophisticated scam targeting businesses and organisations, whereby criminals employ social engineering techniques to gain access to an employee’s or executive’s e-mail account to initiate bank transfers under fraudulent conditions. Finally, spam is any kind of unwanted, unsolicited digital communication that gets sent out in bulk. Often spam is sent via e-mail, but it can also be distributed via text messages, phone calls, or social media .

As expected, the COVID-19 pandemic has given rise to this category of threats, since people’s online presence and need for communication has greatly risen during this period. Moreover, the digitalisation of many traditional services grew at an unprecedented rate during the pandemic, and given e-mail’s lead role as a communications means, the increase in e-mail related threats was undeniable. A list of notable incidents related to e-mail threats can be found in Annex B.

6.1 TRENDS 6.1.1 COVID-19 still the lure in e-mail threat campaigns

Spam campaigns with COVID-19 related lures were major occurrences throughout the reporting period. In general, COVID-19 was exploited by adversaries to trick end users into falling victims to various types of e-mail related attacks. Exploiting the angst concerning the pandemic and the trust that people place on their e-mail as a principal means of communication, adversaries made use of COVID-19 to spread their campaigns. These campaigns ranged from attempts to trick users into ordering face masks from phony websites to infecting them with malware via malicious attachments. Three-quarters of attachments in these e-mails contained infostealers – a type of malware that steals sensitive information (such as passwords or other credentials). As the pandemic continued and the vaccine was released the lure changed to incorporate that. The campaigns included advertisements or offers for early access to a vaccine upon payment of a deposit or fee and misinformation regarding the vaccines.

ENISA THREAT LANDSCAPE 2021 6.1.2 Postal services used in phishing campaigns

Several phishing campaigns aiming to steal the credit card numbers of victims by sending phishing e-mails related to deliveries from national postal systems have been observed during the reporting period. The e-mails try to lead users to phishing websites that capture their credit information. This attempt has already affected at least 26 countries. In 2021, postal services were also used in massive SMS spam messages that spread the Flubot Android malware across Europe. Malware gangs were sending malicious links to users via SMS posing as legitimate package delivery services.

6.1.3 QRishing: new version of an old scheme

Social distancing during the pandemic has popularised QR (Quick Response) codes, which are simple to use and may be pretty simple to generate. Identifying a fake QR message is not straightforward and it creates a suitable environment for malicious activity. A tactic that has been observed is embedding fake QR codes into phishing e-mails sent by large European banks. Upon scanning the code, users are directed to websites with realistic-looking landing pages, where the victim may be prompted to login in order to renew their credit cards. A fake QR code also has the potential to connect to an unsecured Wi-Fi network or automatically navigate to a malicious link. Codes may also direct users to websites where malware can be automatically downloaded. Moreover, public QR codes could also cause a problem as cybercriminals may swap them out by replacing their own QR codes over genuine ones.

6.1.4 BEC has increased, has grown in sophistication and become more targeted

According to publicly available reports, BEC was the most costly cybercrime type in 2020 during which organisations reported total losses of more than 1.8 billion dollars . During the reporting period, it was observed that BEC schemes have evolved, especially regarding credential phishing and the conversion of money into cryptocurrency. As EU Member States report, there have been many cases where Office 365 accounts have been used for BEC scams. This implies that the actors have also conducted credential phishing operations or password spraying attacks (a technique similar to brute force attacks) against the victims .

Moreover, although cybercriminals target all sectors and businesses, BEC actors show an increased focus on small and medium-sise enterprises . Historically, BEC actors were based in Nigeria but recent research has identified BEC actors in 50 different countries. Half of the BEC-related cybercriminals are located in Nigeria (the reduction in this percentage is due to the efforts of law enforcement) and one-quarter of them are based in the United States. Moreover, the highly lucrative potential of this type of cybercrime has attracted more sophisticated cybercrime groups such as Cosmic Lynx .

Our assessment is that cybercriminals will certainly continue to take advantage of compromised business accounts and use them to make money through BEC scams. It is also likely that this lucrative type of cybercrime will attract sophisticated cybercrime actors globally, further diversifying the current geography of BEC actors and increasing the sophistication of BEC scams.

6.1.5 SMShing and Vishing have increased since users lack the awareness ENISA THREAT LANDSCAPE 2021

In another instance Charming Kitten, (also known as APT35 or Phosphorus), used the 2021 holiday season to attack targets from all over the world using a spear-phishing campaign that involved both e-mails and SMS messages. While the SMS messages posed as Google security alerts, the e-mails used previously hacked accounts. The common indicator in both campaigns was that Charming Kitten operators managed to successfully hide their attacks behind a legitimate Google URL.

In general, users are used to the idea of not clicking on suspicious e-mails, but still are not aware that they can also be phished via text messages or phone calls.

6.1.6 Phishing-as-a-Service (PhaaS)

Microsoft’s recent analysis of the Bullet ProofLink campaign suggests that this operation is responsible for many of the phishing campaigns that have had an impact on organisations. BulletProofLink (also referred to as BulletProftLink or Anthrax by its operators in various websites, ads, and other promotional materials) is used by multiple malicious actors in either one-off or monthly subscription-based business models, creating a steady revenue stream for its operators .

Similar to ransomware-as-a-service (RaaS), phishing-as-a-service follows the software-as-a-service model. Attackers pay an operator to develop and deploy large portions of or complete phishing campaigns from false sign-in page development, website hosting, and credential parsing and redistribution, outsourcing capabilities that they may be lacking.

6.2 RECOMMENDATIONS

The following mitigation vectors were discussed regarding e-mail related attacks and incidents during the reporting period.

ENISA THREAT LANDSCAPE 2021 ENISA THREAT LANDSCAPE 2021 ENISA THREAT LANDSCAPE 2021

7. THREATS AGAINST DATA

Threats against data form a collection of threats that target data sources with the aim of gaining unauthorised access, disclosure, misinformation, disinformation, etc. They are mainly referred to as data breaches or data leaks and refer to the release of sensitive, confidential or protected data to an untrusted environment. Data breaches can occur as a result of a cyber-attack, an insider job, unintentional loss or exposure of data. Data exfiltration or data theft is a technique that is used by malicious actors to target, copy, and transfer sensitive data. A particular case of the use of exfiltrated data is identity theft, where malicious actors use personal identifiable information (PII) to impersonate a user.

Threats against data consistently rank high among the leading threats of the ETL and this trend continues in the reporting period of the ETL 2021. Adversaries explore a series of new techniques and exploit the increasing online presence and use of online services by the general public. Moreover, given the significance of data and in particular of private and sensitive data, adversaries are combining more sophisticated threats to target data, such as ransomware or supply chain attacks. It is noteworthy that in the ENISA threat landscape for supply chains, for about 58% of the supply chain incidents analysed, the customer assets targeted were predominantly customer data, including personally identifiable information (PII) data and intellectual property.

Numerous incidents related to threats against data took place during the reporting period of ETL 2021. Figure 8 shows the incidents observed based on OSINT (Open Source Intelligence) collected by ENISA for the purposes of situational awareness. The scope of the collection is global and multi-sectorial. Incidents, however, with a direct impact in the EU area are given priority. We observed an increasing trend in the number of incidents reported during 2021. This observation relates primarily to the surge of data breaches in the health sector (see trends below). Notable incidents related to threats against data can be found in Annex B.

Figure 8: Incidents related to threats against data observed by ENISA (April 2020-July 2021)

ENISA THREAT LANDSCAPE 2021 7.1 TRENDS

Considering data breaches, the industry sectors suffering the most from internal errors are finance and insurance, public administration, healthcare and information. In the financial sector, 44% of the breaches are caused by internal actors, whose actions are, most of time, due to errors. It is noteworthy that internal actors have been growing constantly from 2018 in this industrial sector, while external actors have been decreasing at the same rate, to the point where the two are very close. In the public administration sector, social engineering is the primary pattern (70%), with errors the second pattern (15%) where misconfiguration and mis-delivery account for most errors. In the healthcare sector, errors are the primary cause, with the top three specific errors being mis-delivery, publishing errors and misconfiguration. Finally, in the information sector, basic web application attacks, errors and system intrusion are the main patterns, together accounting for 83% of all breaches. Misconfiguration covers the vast majority of all the breaches caused by errors (>70%).

According to Verizon, 85% of data breaches involve a human element. This can be easily explained by considering that both social engineering and miscellaneous errors are among the main patterns. Breaches caused by errors differ with respect to other breaches in the variety of data being disclosed. Altogether, the most disclosed data are credentials (60%) and personal data (50%), while in breaches caused by errors the most disclosed are personal data (80%).

Most of breaches caused by errors are discovered within days or hours. This claim can be explained by the fact that people quickly realise the errors they have made. Taking a more general look, the discovery time for breaches of every nature, broken down into organisation sise, show that enterprise-sised organisation do perform better than SMEs, discovering breaches within days in 55% of the cases. SMEs, instead, discover breaches within days in 47% of the cases. These results show that enterprises have significantly improved their performance, while SMEs have basically stayed the same as in 2019.

7.1.1 Threat actors shifted their attention towards COVID-19 vaccine information

Vaccine information became the centre of a few cyberespionage campaigns during the reporting period. In July 2020, the UK foreign secretary issued warnings about active large-scale phishing campaigns which appeared to specifically target COVID-19 research facilities and were believed to be sponsored by nation-states. Later in 2020, phishing schemes with credential harvesting capabilities were found targeting organisations globally, with the intention to extract information regarding the transportation and distribution processes of the vaccines. At the end of 2020, AstraZeneca employees where spear-phished and the incident was attributed to state-sponsored APT groups. Lastly, at the end of 2020 the EMA was targeted and documents concerning the validation process of Pfiser and Moderna vaccines were accessed and leaked to the internet .

7.1.2 Surge in healthcare sector data breaches

Healthcare data breaches are increasing rapidly (see Figure 14). This can be interpreted in a couple of ways. Due to the COVID-19 pandemic, the healthcare sector was put on the spotlight and threat actors took advantage of this crisis to hit an already suffering sector. In addition, due to the pandemic, a shift towards the online provisioning of healthcare services, remote eHealth and telemedicine approaches increased and thus the opportunities for adversaries to exfiltrate medical data increased greatly.

Moreover, the motivation for adversaries to access and exploit medical data is much higher than other types of data. A credit card for example can be easily cancelled, so the perceived value of having the data related to a card is much lower compared to medical records, which contain information, such as a patient’s medical and behavioural health history and demographics, as well as their health insurance and contact information.

ENISA THREAT LANDSCAPE 2021

The increase in healthcare related incidents is also visible in relevant mandatory reporting in the US that require victims to report the breaches. A similar trend is also observed in ENISA OSINT trend analysis as seen in Figure 9.

Figure 9: Data related incidents in healthcare as observed through OSINT by ENISA via situational awareness

7.1.3 Data breaches in the business environment rise

According to SANS Institute, in the last few years, approximately 74,000 employees, contractors, and suppliers were impacted by a data breach due to stolen company laptops. This was exacerbated by the fact that data were not encrypted. In a 2021 study of 300 respondents - including top managers at US companies with over 5,000 employees in the most important business domains - 34% of respondents has been the target of a theft of property or supply chain damage due to insiders abusing their privileges. Among observed physical threats, 27% of the respondents mentioned “insiders abusing authorised cyber and physical access points” in a list of the top-three physical threats, 26% “supply chain damage and/or disruptions”, and 23% “onsite theft/burglary”.

7.1.4 Motivations and attack vectors remain the same

During the reporting period, trends related to the motivations of adversaries as well as the main attack vectors remained generally the same. Phishing continues to be on the top causes of breaches (36%), as it has been for the past two years. It is followed by the use of stolen credentials (25%) and ransomware (10%). As in past years, financially motivated attacks continue to be the most common. Nearly 80% of cyberattacks are for financial gain, such as stealing money directly from financial accounts, stealing credit card information or other types of data that can be monetised, or demanding ransom. In second place is espionage, which often involves the theft of intellectual property or other confidential information

7.1.5 Identity theft and synthetic identity

Due to the increase in data breaches in previous years, personal and sensitive data has been easily accessible to malicious actors via online forums and the dark web. This has had a cascading effect on identity theft. According to the US Federal Trade Commission (FTC), complaints of identity theft rose in 2020 compared to the year before. About a third of these involved US government benefits. Scams were geared towards the new COVID-19 reality such as using

ENISA THREAT LANDSCAPE 2021

stolen personal data to apply for and receive government benefits, stealing money by offering to deliver goods to people that were confined indoors due to the lockdowns, or by impersonating government agencies .

A lot of these incidents could have involved synthetic identities. Synthetic identity theft is a type of fraud in which criminals combine real and fake information to create a new identity. Incidents with synthetic identities tend to be more common in the United States because of static personally identifiable information, which is used to verify someone’s identity, according to the Federal Reserve .

7.1.6 Actors taking advantage of bad user behaviour in order to commit identity abuse

The Identity Theft Resource Centre reported in early 2021 that the motivation of cybercriminals has shifted and instead of targeting consumers in order to steal large amounts of personal information they have started taking advantage of bad user behaviour that are then used against organisations. A typical example involves stolen credentials.

As reported by CERT-EU, “identity abuse essentially consists of using valid accounts and legitimate applications to perpetrate malicious activities in a persistent and stealthy way. Attackers abuse the inherent trust in any action associated with authenticated users or authorised applications. Identity abuse can be seen as an extension of the living-off-the land (LOTL) tactic where an attacker makes use of legitimate tools to remain undetected, whereas, through identity abuse, the attacker will additionally make use of legitimate accounts. Observed tactics showed the unprecedented level of sophistication the adversaries leveraged to abuse their victims’ identities for lateral movement and stealthy operations. They remained undetected for more than six months in the network of hundreds of compromised organisations”. In the SolarWinds Orion campaign, the adversaries abused the highprivileged accounts the application uses; these accounts ultimately underpin identity in an organisation’s environment.

7.1.7 Rising Impact of Supply Chain Attacks

As reported in ENISA’s dedicated threat landscape for supply chains, based on the trends and patterns observed, supply chain attacks increased in number and sophistication in the year 2020 and this trend is continuing in 2021, posing an increasing risk for organisations. It is estimated that there will be four times more supply chain attacks in 2021 than in 2020. With half of the attacks being attributed to Advanced Persistence Threat (APT) actors, their complexity and resources greatly exceed the more common non-targeted attacks and, therefore, there is an increasing need for new protective methods that incorporate suppliers in order to guarantee that organisations remain secure.

Around 58% of the supply chain attacks were aimed at gaining access to data (predominantly customer data, including personal data and intellectual property) and around 16% at gaining access to people. When it comes to suppliers’ data, 20% of attacks were aimed at gaining access to that data and 66% to their source code.

7.2 RECOMMENDATIONS

The following mitigation vectors were mentioned regarding data related attacks and incidents in the reporting period.

 Develop and maintain a cybersecurity awareness plan. Provide training and simulation scenarios for identifying social engineering and phishing campaigns for employees.  Limit user access privileges under the need-to-know principle. Revoke access privileges to anyone who is not an employee .  Establish and maintain an incident response team and evaluate incident response plans frequently.  Discover and classify sensitive/personal data and apply measures for encrypting such data in transit and at rest. In other words, deploy data loss prevention capabilities.

ENISA THREAT LANDSCAPE 2021

 Increase investments related to detection, alerting tools and ability to contain and respond to a data breach.  Develop and maintain strong policies enforcing strong passwords (password management) and usage of multifactor authentication (MFAs).  Consider models that take the least privileged approach to provide security for both on premises and off premises resources (i.e. zero-trust).  Invest in and create policies and plans for engaging with governance, risk management and compliance teams.  Store data only on secure IT assets.  Educate and train the personnel periodically.  Use technology tools to avoid possible data leaks, such as vulnerability scans, malware scans and data loss prevention (DLP) tools. Deploy data and portable system and device encryption, and secure gateways.  A Business Continuity Plan (BCP) is critical in the event of a data breach. This plan outlines the type of data being stored, their location and what potential liabilities could emerge when implementing data security and recovery actions. A BCP entails an effective incident response, which aims at addressing, managing, and rectifying the damages due to such an incident.  Apply ‘threat hunting’ within a company to strengthen security plans. Threat hunting is conducted by skilled members of the Security Operation Centre (SOC) team to proactively identify vulnerabilities and prevent breaches.  Policies such as velocity-based rules can be used to mitigate identity fraud, especially for payment card transactions. The machine data of valid transactions can provide sufficient information for the optimal policy definition.  The Single Sign On (SSO) authentication method, when available, allows a user to access several applications with the same set of digital credentials. It is highly recommended to minimise the number of user accounts and stored credentials using SSO.  URLs that are sent via e-mail or are randomly visited should first be checked based on their IP address, the ASN that associates with the IP, the owner of the domain and the relation between this domain and others, before any further step is taken.  Organisations that are adopting cloud services should have strong cloud security operations and prefer an architecture of on-premises storages, private cloud storages and public cloud storages simultaneously to protect their customer’s personal information.  Use strong and updated encryption methods such as TLS 1.3 (uses ephemeral keys) for sensitive data to prevent hacking.  Adequately protect all identity documents and copies (physical or digital ones) against unauthorised access.  Identity information should not be disclosed to unsolicited recipients and their requests by phone, e-mail or in person should not be answered.  Install and use content filtering to filter out unwanted attachments, mails with malicious content, spam and unwanted network traffic.  Use Data Loss Prevention (DLP) solutions.

ENISA THREAT LANDSCAPE 2021 ENISA THREAT LANDSCAPE 2021

8. THREATS AGAINST AVAILABILITY AND INTEGRITY

Availability and integrity are the target of a plethora of threats and attacks, among which the families of Distributed Denial of Service (DDoS) and Web Attacks stand out.

Distributed Denial of Service (DDoS) targets system and data availability, and though it is not a new threat (it 418 419 celebrated its 20th anniversary in 2019) it remains a significant threat in the cyber landscape. Attacks occur when users of a system or service are not able to access relevant information, services or other resources. This can be accomplished by exhausting the service or overloading the component of the network infrastructure .

Web-based attacks mainly target data integrity and availability. They are an attractive method by which threat actors can delude victims using web systems and services as the threat vector. This covers a vast attack surface, for instance facilitating malicious URLs (Uniform Resource Locators) or malicious scripts to direct the user or victim to the desired website or downloading malicious content (watering hole attacks, drive-by attacks) and injecting malicious code into a legitimate but compromised website to steal information (i.e. formjacking) for financial gain, information stealing or even extortion via ransomware .

DDoS and web-based attacks are often coordinated activities. DDoS attacks can be built on a web-based attack, which are often distributed through web applications. For instance, web-based attacks can be adopted to build a botnet that is then used to carry out a denial of service attack aimed to make a system unavailable.

8.1 TRENDS

Both web attacks and DDoS attacks have remained stable over the years, while some interesting points on their evolution may be noted. According to EUROPOL, “the threat potential of DDoS attacks is higher than its current impact in the EU.” Notable incidents for these two types of attacks can found in Annex B.

8.1.1 Ransom Denial of Service (RDoS) is the new trend of DDoS attacks

During 2020, Ransom DDoS (RDDoS) campaigns got a substantial boost from August 2020 onwards, with hacking groups such as Fancy Bear, Cozy Bear, Lazarus Group, and Armada Collective carrying out these campaigns. Targeted sectors include e-commerce, finance, and travel on a global scale. Extortion attacks have also experienced a boost in terms of numbers and dimensions, reaching capacities of 500Gbps in 2020.

Ransom Denial of Service substantially reduces the need of resources to carry out an attack. Cybercriminals analyse target businesses to find those with weak and vulnerable systems. They then blackmail these businesses by asking a 424 425 ransom so as not to attack the system . Thanks to cybercrime-as-a-service tools, in fact, launching an RDDoS

ENISA THREAT LANDSCAPE 2021

attack is increasingly simple, while it is still difficult to spot its origin. Infecting a target with malware or ransomware would otherwise require more effort in terms of time and planning .

RDDoS comes in two flavours: i) attack-first, ii) extortion first. In the first case, a DDoS attack is implemented and a ransom is requested to stop it. In the second case, an extortion letter and proof in the form of a small-scale DoS is sent with a request to pay a ransom. RDDoS attacks are even more dangerous than traditional DDoS since they can be completed even if the attacker does not have sufficient resources.

8.1.2 COVID-19 Pandemic has been used as an amplifier

DDoS attacks were boosted substantially in 2020 due to COVID-19 with more than 10 million attacks (1.6 million more than 2019) and a 22% increase in attack frequency in the last 6 months of 2020. In March 2020, a new norm began with over 800,000 DDoS attacks registered, an average of 839,083 attacks per month over the year and with more than 929,000 attacks in May 2020. Global DDoS extortion attacks also increased by 125% becoming one of the most critical approaches to DDoS.

In addition, videoconferencing and remote collaboration software, such as Microsoft Teams, Skype or Zoom, experienced a peak of usage. However, their usage comes with some concerns. First, these tools are often built on weak communications possibly leading to attacks. Then, their high demand in terms of bandwidth can stress the network. Furthermore, the massive adoption of remote working increased the risk for organisations of becoming a target of a DDoS attack. In addition, the bandwidth originally devoted to counteracting DDoS is currently used for remote working, reducing an enterprise’s ability to defend itself against a DDoS attack. In this context, the impact of DDoS attacks against RDPs and virtual private networks (VPNs) increased with the pandemic.

Due to COVID-19, malicious actors increasingly targeted home networks as a starting point for more complex attacks, making DNS not only an attack vector but also a target of attacks. According to Neustar (NISC Survey, Q4 2020), Domain Hijacking (31%) has been the most observed DNS threat, followed by DNS Spoofing/Cache Poisoning (27%), DNS Tunnelling (26%), and Zombie Domain Attacks (18%).

8.1.3 Cybercrime-as-a-Service works as an amplifier of web-based and DoS attacks

Cybercrime-as-a-Service is becoming a cornerstone for spreading DDoS, opening the door of DDoS to a wider population of attackers. Illegal online markets providing accesses to attack tools and services, as well as fast internet connections are further supporting cybercriminals in driving more complex and sophisticated campaigns, and disruptive attacks. State-sponsored actors aim to develop their capabilities to disrupt critical infrastructure and conduct espionage against businesses, academia, and governments to steal intellectual property.

DDoS is increasingly implemented using cybercrime-as-a-service: a criminal pays for a DDoS attack-as-a- 432 423 service and the paid service launches the DDoS attack. These services reduce the effort needed to manage high-volume and complex attacks, making DDoS adaptive, lightweight, and heterogeneous. DDoS is increasingly targeting smaller businesses and requiring less financial and technical resources. Potentially disruptive attacks can target third-party providers (e.g. financial, energy and telecommunication services), with cascading effects in the 419 433 supply chain.

Cybercrime-as-a-Service in fact provides a set of online tools and services that simplify the execution of targeted attacks. We then have a coordinated effort between expert cybercriminals that provide tools and expertise and low-

ENISA THREAT LANDSCAPE 2021

skilled cybercriminals who identify vulnerable targets, who share revenues. DDoS-For-Hire-Services are among the most adopted tools for cyberattacks. In general, we may note that DDoS attacks are today mostly multivector and amplified by COVID-19. They also show a boost in dimension and impact, while impacting almost all businesses’ domains thanks to the rise of extortion attacks. Finally, according to research conducted by Digital Shadows, “three main trends that can be expected to persist throughout 2021 include leveraging IoT devices, offering DDoS service solutions, and DDoS extortion.”

8.1.4 Traditional DDoS is moving towards mobile networks and IoT

The success of internet of things (IoT) in conjunction with 5G is resulting in a new wave of DDoS attacks, possibly inducing victims to pay a ransom. On one hand, 5G makes IoT more vulnerable to cyberattacks, supporting localised DDoS where an attacker interferes with the connectivity of a specific area covered by a slice through a set of compromised devices. On the other hand, IoT can be used as a threat vector for DDoS. Attackers can build massive botnets to launch DDoS attacks or distribute malware. This is particularly critical in Industrial IoT (IIoT), where device vulnerabilities can disrupt business operations and cause significant damage (e.g. in the health domain, vulnerable medical devices can affect people’s safety).

Sensors and devices are in fact a suitable target of DDoS attacks due to their limited resources that often result in poor security protection. Devices are simple to corrupt, often coming with misconfigurations (e.g. weak passwords). At the same time, the increasing complexity of these mobile systems makes users’ shortage of security skills increasingly pertinent. In this context, DDoS aims to threaten the availability of components, as well as disrupt the operation of other networks or systems. It also has the potential to threaten the safety of users. The increasing number of devices and applications connected to the cloud gives adversaries a larger playing field on which to target attacks.

Lack of industry standards, network capabilities, and hardware can challenge service uptime and

reliability. This problem is exacerbated in IIoT, where vulnerabilities in third-party software components clearly point to a lack of standardisation and safe coding guidelines.

8.1.5 New amplifiers and advanced sophistication for DDoS attacks emerge

Sharing of resources in virtualised environments acts as an amplifier of DDoS attacks. Physical resource overloading can cause disruption in communications, services, and access to data.

DDoS attackers are adopting intelligent strategies based on technically advanced and smart attacks. In 2020-21, smart attacks used publicly available information to monitor the countermeasures adopted by their targets and adapt their attack strategies at run time. In this context, the duration of short attacks decreased, while the duration of long attacks increased. Focusing on absolute numbers, the number of short attacks had a sharp increase in Q1 2021, 589 441 while long attacks decreased though their overall duration increased . Sharing the same view, Akamai, at the end of March 2021, observed more attacks over 50 Gbps than during the whole of 2019. Even more important, in the first quarter of 2021, they recorded three of the six biggest DDoS attacks by volume, including the two largest known DDoS extortion attacks.

ENISA THREAT LANDSCAPE 2021 8.1.6 DDoS campaigns in 2021 have become more targeted, multi-vector and persistent

The attackers look for weaknesses to exploit and try different attack vector combinations. 65% of DDoS attacks were 442 434 multi-vector. Independently from the statistics, DDoS attacks are increasingly becoming multi-vector. According to NEUSTAR, built-in access protocols have been used as attack vectors, resulting in the FBI releasing a warning in July 2020 that common network protocols like Apple Remote Management Services (ARMS), Web Services Dynamic Discovery (WS-DD) and Constrained Application Protocol (CoAP) were abused by hackers to conduct DDoS reflection and amplification attacks. Furthermore, some DDoS threats build on TCP-based attacks, including TCP SYN and fragmented packet floods. NEUSTAR shares the view that the majority of attack vectors for DDoS attacks focus on UDP protocols, such as Network Time Protocol (NTP), Connection-less Lightweight Directory Access Protocol (CLDAP), Internet Control Message Protocol (ICMP) and Domain Name System (DNS).

NETSCOUT, with its intelligent threat report, provided a detailed discussion of DDoS threat vectors. It claimed that the total number of vectors for individual attacks increased substantially, culminating in an attack composed of 26 attack vectors in 2020. Multi-vector attacks are mostly in the range 15-25 vectors and showed an increase in cardinality between 9% and 312%, with the most notable growth in the range of 15-21 vectors.

8.1.7 Smaller organisations are being targeted

DDoS is increasingly targeting small enterprises by building on the rental of skill and tools to implement attacks (Cybercrime-as-a-Service). This finding was previously discussed in IOCTA 2020, claiming that cybercriminals increasingly target smaller organisations with lower security standards, ensuring successful attacks with smaller volumes of data and maximum revenue. Public institutions and critical infrastructures remain among the main targets of DDoS attacks.

8.1.8 Increased combination of web-based and DDoS attacks

Recalling that DDoS and web-based attacks are often coordinated activities, web applications are still vulnerable to web-related threats, such as injections and cross-site scripting, and can become a vector for DDoS attacks. According to a recent report , SQL injection vulnerabilities and PHP injection vulnerabilities are the most commonly exploited, though XSS is the most discovered vulnerability. According to the Verizon 2020 Data Breach Investigations Report (DBIR), cross-site scripting (XSS) traffic experienced a substantial increase in Q4 2020; blocked cross-site scripting (XSS) traffic nearly doubled in volume from Q2 2020 to Q4 2020, with more than 15 million attacks, representing 10% of blocked traffic. Furthermore, 43% of all data breaches involved a web application and around 90% of all hacking

ENISA THREAT LANDSCAPE 2021

vectors targeted web applications. The latter data was also confirmed in the Verizon 2021 Data Breach Investigations Report (DBIR).

8.1.9 Trends on classifying DDoS attacks

The geographical spread of DDoS attacks in 2020-21 depends on attack classification, though some commonalities 446 447 emerge :

 China and USA are always mentioned in the first two places both as targets and sources of DDoS attacks.  Netherlands, Germany and France are often at the top places in the EU as targets and sources of DDoS attacks.  In 2021, Canada, Netherlands, France, Great Britain, Germany, Brazil and Australia had sharp increases as sources of attacks, with Canada moving to spot #3. Similarly, Great Britain, Germany, France, Brazil and Australia experienced sharp increase as targets of attacks, with The Netherlands moving to spot #3. Also, unexpectedly, Poland entered the top ten.  According to Cloudflare, Malaysia and India are the #3 and #4 source countries, while Morocco became the #3 target country.

Concerning the sector spread, Akamai monitored data from 2017 to the end of 2020 and observed an increase in the number of DDoS attacks over the 50 Gbps threshold. Moreover, a general increase in attacks in 7 out of 11 of the analysed sectors was observed with a sharp increase in Business Services (960%), Education (180%), Financial Services (190%), Retail & Consumer Goods (445%), and Software & Technology (196%).

Confirming these results, F5 labs claimed, “the education sector saw a large increase in DDoS attacks in January 2021, with more than 56% of all education incidents for the past 15 months occurring in Q1 2021”. Concerning the domains attacked, technology, telecommunications, and finance are in the first three places, while if we compare the number of attacks with the average attack sise, healthcare is the most critical domain.

8.1.10 Web-based attack main trends persist

Web Attacks includes threats, such as injection and application malfunctioning, affecting IT systems in their entirety. Modern IT systems are based on services composed at run time, which can be the target of attacks and breaches. These services often expose a standard API interface (e.g. REST, RPC) and interact on virtual networks or orchestration platforms, introducing new security challenges to cope with. At the same time, “traditional” (i.e. desktop, client-side) applications suffer from long-standing issues that are still a source of bugs and attacks. Though web attacks have remained stable over the years, we can note some interesting points as follows.

 Security Misconfiguration. Unpatched software, use of default accounts or unused pages are the preferred means exploited by attackers to bypass security protections and gain unauthorised access to systems. These holes can be found at all layers of a system and are difficult to manage.  Automated brute force, dictionary, and session management attacks are increasingly adopted. For instance, Remote Desktop Protocols (RDPs) are exploited by attackers for malware infection; to do this, attackers search for specific open ports in order to implement brute force attacks.  Cyber-attackers are turning security defences into weapons. For instance, secure channels can be used to cover malware distribution, to disrupt secured transactions, and for data exfiltration.  Untrusted compositions. Composite services are increasingly composed of atomic services to provide advanced functionalities, while introducing new risks that go beyond the risks faced by atomic services. On one hand, composite services can increase the risk of data breaches by combining the different sources

ENISA THREAT LANDSCAPE 2021

of information they have. On the other hand, the composition of atomic services could entail an endemic risk related to the fact that the strength of a composite application is the one of its weakest link.  Many of the OWASP Top 10 Vulnerabilities are due to misconfigurations , an issue discussed in Chapter 10 of the ETL 2021. Injection and cross-site scripting (respectively number 1 and number 7 in the list of the OWASPs most critical web application security risks) exploit system misconfigurations, such as insufficient data validation. In addition, default configurations are often insecure and cause web-based attacks. Finally, a lack of server-side verification or access controls introduces a level of risk, especially when auxiliary services are requested.  According to the OWASP ,web-based attacks exploit components with known vulnerabilities. Also, they benefit from insufficient logging and monitoring.

8.2 RECOMMENDATIONS

Both DDoS and web-based attacks are long-standing threats and several mitigation measures are well known and established. In summary, we present in the following some fundamental mitigation vectors for DDoS and web-based attacks, with a particular focus on trends that emerged during the reporting period.

 A denial-of-service response plan is fundamental for organisations where resilience is a priority and should integrate system checklists, response teams, and efficient communication and escalation procedures.  The security process should be a continuous activity that follows and adapts system and network evolutions and life cycles.  Collaboration and coordination between relevant organisations is important to multiply and strengthen mitigation efforts.  Implement DDoS protection using an on-premises solution, DDoS scrubbing service, or a hybrid solution.  Use both network and web application firewalls . The first can be coupled with approaches mitigating peaked traffic such as a Content Delivery Network (CDN), a load balancer and scalable resources. The latter is particularly useful in case DDoS is based on injection or XSS.  Use antivirus solutions to curb malware infections.  Use a network-based intrusion-detection system.  Apply patches promptly, especially when many employees use their personal machines for work. Organisations should give high priority to system updates and deliver them to users remotely.  Traffic profiling and traffic filtering may assist in providing early warning signs of abnormal traffic patterns that are an indicator of DDoS attacks.  Use DDoS mitigation services to detect abnormal traffic flows and redirects traffic away from your network, as well as rate limiting to restrict the volume of incoming traffic.  Protect web-based APIs and monitor for related vulnerabilities.  Fortify DNS or even consider a managed DNS service. Cache poisoning or similar exploits can be prevented by the use of DNSSEC, or even better a managed DNS vendor supporting the DNSSEC specification.  Consider a multi-layered solution mixing detection, investigation, and response capabilities across multiple platforms.  Build a threat intelligence program based on a proactive approach that adapts the security posture to the evolving threat environment.  Use staff training and cybersecurity exercises to increase capacity building and preparedness.

Countermeasures for mitigating web-based attacks are as follows:

 Set up a web application firewall (WAF) to identify and filter malicious requests. WAF must be kept updated to protect the system against newly discovered vulnerabilities.  Strengthen the code base (e.g. input sanitisation, parametrised statements) to protect against injectionbased attacks.

ENISA THREAT LANDSCAPE 2021

 Promptly update software to avoid zero-day attacks.  Properly configure and harden web servers and regularly patch all servers exposed on the Internet.  Continuously verify the effectiveness of your security hardening, using attack tools, vulnerability scanners, and penetration test services.  Enable logging and inspect those logs.

ENISA THREAT LANDSCAPE 2021 ENISA THREAT LANDSCAPE 2021

9. DISINFORMATION - MISINFORMATION

The rise in the use of digital technologies and social media has changed the way in which people access information and news. Unlike traditional media (e.g. newspapers, TV), social media guarantees direct access to information with no filters. The price we pay for such a convenient way of accessing information is the increasing risk of retrieving fake news and manipulated information. In this context, social media assumes the role of preferred amplifier of information, much more than what happened with the advent of traditional media. This information may be fake (therefore changing perception of reality in people) or real (information about incidents, errors, losses, opinions, and reputation regarding a company). The amplification effect of (social) media is an important threat to individuals, enterprises and even states, because an item of false news can be perceived as real, while an apparently minor problem might become a major incident in public opinion. In addition, social media can be manipulated to distort the market or become effective vectors of misinformation/smear campaigns against a company or the reputation of some of its most representative individuals. The brand reputation, financial solidity of the company, and the trustworthiness of the management as well as the honesty and trustworthiness of individuals are therefore put at risk.

Media-driven market manipulations and misleading public-opinion campaigns were boosted in recent years thanks to new technologies that increase the ability to spread fabricated information. Two main attacks emerged, namely, disinformation and misinformation. Though often perceived as similar, since they refer to inaccurate, incorrect, or 462 463 464 misleading information, they entail fundamentally different concepts.

Disinformation is an intentional attack that consists of the creation or sharing of false or misleading information. Disinformation attacks experienced an exponential boost in the COVID-19 pandemic era, for instance, targeting people’s trust on vaccines.

Misinformation is an unintentional attack, where sharing of information is done inadvertently. Inaccuracy carried by the information is unintentional and could happen for example when a journalist reports wrong information in good faith or reports information by mistake. The spread of misinformation also includes scenarios where people believe a news item regardless of veracity because it supports their worldview.

One may argue about the how these threats relate to cybersecurity. It is important to note that disinformation and misinformation attacks are among the preparatory activities at the basis of other attacks (e.g. phishing, social engineering, malware infection). Moreover, such threats are often used in tandem with other cybersecurity threats, thus leading to advanced hybrid threats. It should also be underlined that the main aim of these threats is to undermine trust, which is the foundation of cybersecurity. By shattering that foundation, cascading effects ripple throughout the whole cybersecurity ecosystem and may have severe implications.

The success of these attacks is due to the spread guaranteed by social media, and has both technical and social 465 466 foundations. Social media amplifies news and circulates information independently of its accuracy. Technical

ENISA THREAT LANDSCAPE 2021

features such as lists of trending topics contribute further to this circulation. In addition, many sites flourish because their intent is to make money through advertising. Their goal is not to circulate true or false information but rather to collect clicks (clickbait), which has the side effect of spreading misleading information.

The complexity of this scenario is due to the difficulty in distinguishing the real intent of a piece of information or even its originator. This is even more difficult when information campaigns are analysed in detail. Different campaigns exist and their boundaries are quite difficult to draw. For instance, the differences between advertising, public relations, public diplomacy (or public affairs), information operations, and propaganda are quite blurred, since they all represent information campaigns whose understanding depends on personal interpretation.

This huge flow of dis- or mis-information is flooding people with the goal of causing uncertainty, apathy towards truth, exhaustion in trying to find it, and fear. It is becoming increasingly clear that policy-makers should put disinformation at the core of their agenda, while also including security and privacy implications.

Social media are the most critical vector for misinformation and disinformation attacks. They permit direct access to information with no filters, increasing the risk of encountering fake news and manipulated information. Social media are also the preferred amplifier of misinformation and disinformation attacks, bringing those attacks on a large-scale. Technical peculiarities of social networks also increase the circulation of (fake) news such as trending topic lists. This is further amplified when people are in social relations and exchange information with like-minded people sharing the same beliefs, creating the so called “Echo Chamber” effect.

Examples of social media-based attack vectors are celebrities or influencers spreading disinformation, social media groups promoting material for supporters. Traditional approaches are also used to carry out disinformation or misinformation attacks such as the spread of malicious accounts: bots, spammers, fake domains, and cyborgs. Social bots have attracted a huge interest and have been massively adopted. Some studies, on Twitter, claimed that social bots can represent between 5 and 15% of users and are responsible for misinformation campaigns, phishing attacks, election and market manipulation.

Starting from the above vectors, two main classes of threat agents are playing the disinformation/misinformation role. On one hand, we have state-backed groups implementing state-sponsored attacks. On the other hand, we have cybercriminals, that is, non-state and private commercial organisations benefiting from the increasing availability of Disinformation-as-a-Service. For instance, conspiracy narratives are distributed by terrorists, extremists and organised criminal groups to manipulate people. In general, a large part of attacks is managed by non-state domestic actors, while both types of agents are increasingly targeting the private sector to spread misinformation, and 474 475 manipulate the market or attack the reputation of competitors. Misinformation and disinformation are increasingly distributed as chains of messages, social media content, deepfakes, and phishing via voice, text, and email.

ENISA THREAT LANDSCAPE 2021

Misinformation and disinformation have different targets and means, as well as goals. They may aim to cause financial and reputational damage and arouse a lack of trust in society at all levels. An overview is presented in Table 2.

Table 2: Misinformation and Disinformation: Target, Means, and Goals

Target Means Goal

Reduce perceived honesty and People Disinformation, misinformation, fake news trustworthiness of individuals

Affect brand reputation, financial solidity of Market distortion, misinformation, disinformation, Enterprises the company, and the trustworthiness of smear campaigns, fake news, propaganda the management.

Inability to distinguish real and fake news, apathy, exhaustion in trying to find the Society Disinformation, fake news truth, manipulating and misleading publicopinion

Any Sharing of inaccurate information Make money based on advertisement

Figure 10 shows incidents based on OSINT (Open Source Intelligence) collected by ENISA for the purposes of situational awareness. The scope of the collection is global and multi-sectorial. Incidents, however, with a direct impact in the EU area are given priority. Notable misinformation and disinformation incidents are included in Annex B. More work is needed to better classify cyber incidents related to disinformation and misinformation, since a lot of them are classified in other categories given that they are commonly used in complex, hybrid attacks. This is the reason why there is a constant fluctuation throughout the year as evidenced by the figure.

Figure 10: Misinformation and disinformation incidents observed by ENISA (April 2020-July 2021)

ENISA THREAT LANDSCAPE 2021 9.1 TRENDS

The Global Risks Report of the World Economic Forum reports that “disinformation and misinformation campaigns can erode community trust in science, threaten governability and tear the social fabric. According to the GRPS, a ‘backlash against science’ will heighten the risks of ‘climate action failure’ and ‘infectious diseases’ over the next decade.” Dissemination of disinformation on elections, humanitarian crises, and public health, security and cultural issues is expected to increase over the next decade. Political divisiveness acts as an amplifier of disinformation and is affecting public trust, especially in those countries (e.g. US) where a non-negligible number of individuals primarily access political news through social media (2020).

Some interesting and important points emerge and are summarised in the following.

 Phishing is at the heart of disinformation attacks and it strongly exploit the beliefs of people.  Human-centric threats are difficult to analyse in pragmatic terms, including the ability to describe, decompose, classify, and reproduce them to feed quantitative analyses, graphical or numerical simulations, or coding into algorithms.  Disinformation attacks benefit from the difficulty of quantifying everything connected with humans. When the threat involves or depends on people's behaviour (e.g. errors, cognitive bias, skill shortages), measurements and data collection are complex processes that often result in poor-quality data.  The problem around disinformation is not the ability to distinguish true or false information; instead it is a social and epistemic crisis amplified by the evolving media and political context.  Disinformation that is moving from political/social spheres to the corporate world is growing in scope and impact thanks to social media platforms and content creation technologies.

9.1.1 AI-enabled disinformation supports attackers in carrying out their attacks

Deepfakes technology is evolving quickly. Supporting technology makes the creation of deepfakes simpler, while social media help in spreading them . Additionally, misinformation and disinformation campaigns are becoming 486 487 more credible thanks to deepfakes, which cannot yet be fully counteracted.

9.1.2 Coronavirus pandemic used for amplification of attacks

COVID-19 is a top topic for disinformation attacks, resulting in what the World Health Organisation (WHO) warned as 488 464 an infodemic of online dis/misinformation. Disinformation campaigns aim to spread fear, uncertainty and doubt around the effectiveness of Coronavirus vaccines. This is used as the basis for social engineering attacks. It also targets the beliefs of individuals, reducing trust in information sources and impacting business brands. Businesses and individuals are targeted by disinformation campaigns focused on green pass, mandatory vaccination, health passports, mass immunity testing, and lockdowns.

ENISA THREAT LANDSCAPE 2021

COVID-19 pandemic resulted in an infodemic of online misinformation as stated by the WHO, on the one hand, and disinformation services, on the other hand. Focusing on disinformation and the COVID-19 pandemic, AVAST went a step further and indicated that 2020 was the year of fake news and COVID-related scams. Cybercriminals used the pandemic for financial and reputational damage, reducing the trust in the scientific community and vaccines, as well as trying to spread malware using COVID-related ads and apps distributed through social networks (e.g. TikTok, YouTube, Instagram). As an example, during the lockdown imposed to flatten the COVID-19 curve, experts were competing with substantial campaigns of online misinformation and disinformation . In more detail, fake shops related to COVID-19 proliferated, as well as scams targeting people interested in information related to COVID-19. Six hundred malicious apps proposing COVID-19 services contained trojans/spyware. Avast also reported the rise of deepfakes especially related to pornographic domains and targeting normal people (e.g. TikTok users). The UK’s National Cyber Security Centre, in April 2020, removed 2,000 scams, including 471 fake online shops, and 200 490 491 phishing sites. In this context, politicians, policy makers, legislators are pressing social media enterprises (e.g. Google, Facebook, Twitter) to find countermeasures and limit the proliferation of misinformation/disinformation campaigns.

9.1.3 Disinformation-as-a-Service (DaaS)

Professional disinformation is produced on a large scale by major governments, political parties, and public relations firms. Since 2019, a growing number of third parties have been offering disinformation services, providing targeted attacks on behalf of clients. Services are provided in numerous countries and an increasing number of non-state and private commercial organisations are using them. In this context, disinformation has moved from political and social spheres to the corporate world. The University of Oxford monitored the manipulation of public opinion using social media by governments and political parties, and the various private companies and other organisations they work with to spread disinformation. From a geographical point of view, disinformation and misinformation are targeting every country in the world.

9.2 RECOMMENDATIONS

Mitigation vectors include both technical and non-technical domains. On one side, mitigation vectors are manual and human-based approaches targeting training and awareness, fact checking and debunking, regulations, and communication. On the other side, technical solutions are important to limit the spread of mis/disinformation through social networks. Co-operation between all actors is important to further limit the impact of mis/disinformation attacks.

In general, the following approaches may be explored to mitigate misinformation and disinformation campaigns.

 Training and awareness: is the process preparing employees in managing disinformation attacks, and also in 498 499 assessing any e-mail and report. In this context, following a vaccine-like approach, prebunking aims to expose users to a small amount of mis/disinformation to prepare them to manage mis/disinformation later on. Other approaches focus on gamification, where a simulation of social media feeds is used to teach users in distinguishing real and fake news. For instance, online game, “Go Viral!“ aimed to prebunk common misinformation surrounding COVID-19.

ENISA THREAT LANDSCAPE 2021

 Mis/disinformation identification: guidelines are emerging to identify fake content as well as to access content

undertaken to counteract the infodemic around COVID-19.  Regulations: new regulations (such as the proposed EC Digital Services Act ) and punishments for sites,

including social networks, spreading fake news are under way. In the context of the GDPR (General Data

Protection Regulation), it is possible to limit access to information that enables targeted advertising. Accordingly, GDPR can help against misinformation by regulating the processing of personal data by online targeted advertising – which is also a tool used for spreading fake news. So GDPR, by regulating online targeted

advertising, could also indirectly contribute in a broader way to the limitation of misinformation. The Code of Practice on disinformation provides self-regulatory standards to fight disinformation with the support of industry. The EU recently released the Fifth Progress Report on “the implementation of the 2016 Joint Framework on

countering hybrid threats and the 2018 Joint Communication on increasing resilience and bolstering capabilities to address hybrid threats”. The report discussed the need to protect free and fair elections, the role of strategic

communications and a centre of excellence for countering hybrid threats, the importance of cooperation among countries and resilience against radicalisation and extremism.  Strategic and transparent communication: that is factual and separate from political communication.

o Rewriting search engine algorithms  Social network detection and mitigation: i) suspension of fake accounts (e.g. accounts that post

duplicate or redundant information), ii) mechanisms to filter and flag fake news, iii) reductions of

automatic activities (e.g. Bots), iv) artificial Intelligence tools and platforms to detect fake news

based on online approaches, v) data science/big data visualisation to identify the large-scale spread of disinformation, vi) mobile apps and chatbots powered by factcheckers targeting the

general public, vii) web-browser extensions for the general public, viii) digital media information literacy platforms and tools o Awareness campaigns through advertisements o Credibility rating, flagging suspicious behaviour

o Digital watermarking (tagging visual content) o Creation of protection strategies centred around sentiment tracking and dark web monitoring.

ENISA THREAT LANDSCAPE 2021 ENISA THREAT LANDSCAPE 2021

10. NON-MALICIOUS THREATS

Threats are commonly considered as voluntary and malicious activities carried out by adversaries who have some incentives to attack a specific target. In these sections, we cover threats where malicious intent is not apparent.

Non-malicious threats are mostly based on human errors and system misconfigurations , but they can also refer to physical disasters that target IT infrastructures. Non-malicious threats can be classified in two categories:

Errors and Misconfigurations are caused by negligence, lack of awareness or, simply, human errors. These include:

 errors when managing an IT system: i) misconfigurations introduced when specific applications and systems are (re-)configured and updated; ii) erroneous system management including errors in patching and updating a system; iii) erroneous system administration, for instance, in distributing privileges among users; iv) issues in the management of traditional systems such as network security, access control, identity management.  development-time errors: i) issues with the management of dependencies; for instance, libraries that are used without developers even noticing; ii) long-standing issues, for instance, memory safety, unsanitised inputs and, 519 520 521 522 in general, issues with well-known solutions involving the use of modern tools, iii) other forms of 523 524 525 negligence, for instance, storing application credentials on public repositories.  application-level errors: i) errors introduced when using an application/system, ii) misconfigured (cloud) applications and poor password and key management; for instance, publicly available buckets, unencrypted databases, iii) minor errors, such as sending an e-mail to the wrong recipient.  physical errors: i) unattended devices, ii) unsecured documents/information, iii) exceptions to physical access rules.

Physical Disasters can be classified as:

 damages to or failures of physical infrastructure, such as inadvertent damage to fibre cables, loss of Internet connection, fire, unstable power supply,  natural disasters, such as floods and earthquakes, causing the unavailability of the IT infrastructure and related services/applications.

For non-malicious threats, we can distinguish between four main actors:

 Normal Users interact and use a system with all privileges needed to carry out a specific and limited activity on it.  Privileged users (Admins) have root privileges on the system and are responsible for system configuration and management. Intuitively, and confirmed by some reports, the damage caused by an error committed by these users is typically much higher. These also include users responsible for physical IT infrastructure.

ENISA THREAT LANDSCAPE 2021

 Developers design, code, implement and maintain a specific software, service or system.  Service/Cloud providers supply a service or cloud functionality that is then integrated within the system. This category can also be broadened to include third-party providers of software libraries and components.

Depending on their role, different types of non-malicious threats can be associated to actors as seen in Table 3:

Table 3: Mapping between non-malicious threats and actors

Threat Category Threat Type Actors

Errors made when managing an IT system Privileged Users

Development-time errors Developers, Service/Cloud Providers

Errors and Misconfigurations

Application-level errors Users, Privileged Users

Physical errors All Damages to or failures of physical infrastructure Privileged Users, Cloud Providers

Physical Disasters

Natural disasters None

Non-malicious threats represent a major threat vector for many existing malicious threats. For instance, security vulnerabilities, misconfigurations, inadequate vulnerability and patch management can open the door to DDoS attacks, malware and ransomware. At the same time human errors are a major vector for phishing and social engineering. Notable non-malicious incidents are included in Annex B.

Misconfiguration is the most common attack vector (approximately 50%), followed by misdelivery (approximately 30%), based on a 2021 report by Verizon on data breaches. Programming errors account for a very small percentage, stressing the fact that often security measures do exist and work correctly but are not applied. Cloud misconfigurations substantially boosted and, according to Palo Alto Networks, can be classified in two main categories: i) storage and encryption issues, ii) network issues. Encryption of data at rest and in transit remains among the major misconfigurations, as well as permissive policies, lack of sophisticated protections and storage available publicly. Also, non-malicious vectors/threats are rising in the case of the Internet of Things (IoT) with i) exploitation of device vulnerabilities (41%, including 3% zero-day) and ii) user practices (26%, 13% password-based) in the top spots.

Considering non-malicious threat agents and vectors, the statement that points to “humans as the weakest part in a system” is becoming increasingly relevant. Major threat vectors are lack of training and skills, as well as awareness, in the users, developers and administrators. Lack of standardised processes, as well as weak configurations by default (e.g. encryption disabled by default), are increasing the probability of an error/misconfiguration. All these vectors coupled with the increasing complexity of modern systems that mix Cloud, Edge and IoT make current scenarios a ticking time bomb. At the same time, weak physical infrastructures not ready to face destructive natural events, as well as lack of proper plans for utility management open the doors to disasters that might impact the availability of the system.

Major inadvertent threat agents are therefore individuals who have different roles in system life cycles as end users, privileged users, developers and cloud/services providers. Considering errors and misconfigurations, in virtually all cases the threat actor is internal, for instance, an employee inadvertently publishing some records, or an IT manager not securing properly an S3 bucket. In more detail, internal actors account for 99% of breaches, the remaining percentage is divided among partners and a combination thereof. Among internal actors, the three most frequent are

ENISA THREAT LANDSCAPE 2021

system admin (approximately 50%), developer (approximately 30%), and end user (approximately 20%). However, the possible damage of such breaches is typically much higher in the first two cases, since i) system admins are the most powerful users controlling virtually all the systems; ii) developers frequently have privileged access to data. Regarding physical disaster, threat agents are either the users acting on and managing the physical infrastructure, or natural events impacting the physical infrastructure.

10.1 TRENDS

In summary, non-malicious threats have historically had an important impact on the working of IT systems and applications, but their impact is being exacerbated by i) the increasing complexity of the systems and infrastructures; ii) the increasing migration to cloud environments and integration of IoT devices and edge computing, often with limited amount of time, skills and resources; and iii) the COVID-19 pandemic. On top of this, skills shortages and well-known vulnerabilities or misconfigurations continue to be an issue.

10.1.1 Errors and system misconfigurations are the most frequent reported root cause

In 2020, out of the incidents with significant impacts reported under the NIS directive , 17% were flagged as human errors, while system failures remain the most frequent root cause of reported incidents at a rate of 48%. The causes these incidents were software bugs and hardware failures. This was a continuing trend as similar figures were reported in 2019.

Similar trends are also observed for Telecommunication and Trust services in 2020:

 System failures in the telecom sector maintained the widest impact with almost 50% of the total user hours lost and were the most likely root cause of incidents (61%). Faulty software changes/updates accounted for 41% of the total user hours lost and 24% of the total incidents. Human errors accounted for 41% of the total user hours lost, and were the root cause of 26% of total incidents (an increasing trend). Third party failures remain stable at 29%.  System failures accounted for more than half of the incidents in the trust services sector in 2020, and were the major root cause (53%). Human errors were the root cause of 39% of the incidents.

10.1.2 COVID-19 increased the number of non-malicious incidents due to migration to the cloud

The pandemic forced a migration to the cloud, causing a substantial increase in cloud workloads between October 2019 and February 2021 all over the world: 70% in the APAC region, 69% in the EMEA region, 65% in the AMER 539 539 region and 58% in Japan . According to Palo Alto networks, the industries with the highest increase in security incidents (Retail 402%, Manufacturing 230%, Government 205%, and Pharma and Life sciences 127%) were among those that increased their cloud workloads significantly due to the pandemic.

A huge number of recent data breaches is caused by misconfigured buckets. While many of them revealed personal information, it is also common to find credentials and secrets stored in buckets. Using simple crawling techniques, Truffle Security built an initial list of 4,000 open S3 buckets which, due to file name patterns, were likely to contain environmental variables and other secrets. Files matching those patterns contained an average of 2.5 secrets. Furthermore, some of them also contained credentials to open authenticated buckets and secrets for other services, from database passwords to PayPal credentials and JWT secrets.

ENISA THREAT LANDSCAPE 2021 10.1.3 Vulnerabilities and bugs continue to play a prominent role

In 2020, NIST received more than 18,000 new CVEs (fourth year in a row that this number grows) , and this trend seems to be continuing in 2021 .

The 2020 also saw a never-seen-before spike in IoT malware, exploiting devices that are, in most cases, unsecure and never patched properly. The challenges behind unsecure IoT are well-known and detailed, for instance, the IoT Top Ten by OWASP contains vulnerabilities such as Insecure Ecosystem Interfaces, Lack of Secure Update Mechanisms, Use of Insecure or Outdated Components and Lack of Device Management. Sonicwall reports an even faster increase in the first half of 2021. In homes due to school reopenings, the rise in COVID-19 cases and the growth in the number of IoT devices.

On the contrary, the exploitation of vulnerabilities accounts for only 3% of breaches . When organisations expose some vulnerable hosts on the Internet, such vulnerabilities are quite old and attackers still actively exploit them. According to Verizon, 20% of organisations expose vulnerabilities as old as 2010. SonicWall discovered similar old vulnerabilities still being exploited.

These findings stress once again how organisations do not deal effectively with patch management. The scenario of unpatched vulnerabilities and legacy software is particularly critical in the healthcare sector. For instance, 83% of all imaging devices run on operating systems which are not actively supported, including Windows 7. They are also responsible for a high number of security issues, compared to the number of deployed devices, where the imaging systems, patient monitoring and medical device gateways (which account for 34% of all devices) are at the basis of 86% of all security issues.

According to a recent report , the top 30 ecommerce retailers in the US use 1,131 third-party resources each and 23% of them include at least one critical vulnerability. This results in possible cascading effects where a compromise of a system can open the door to compromises in other domains. The total cost of a breach caused by a third party is $4.29 million on average. In this context, Verizon claims that web applications are involved in 43% of the breaches and 80% of organisations experienced an attack from a vulnerability in their third-party software.

According to Aqua Security, SMEs do fix issues faster than enterprises, 75 days vs 88 days (on average).

10.1.4 Physical and natural threats affect digital infrastructures and telecommunications

According to the Annual Report NIS Directive Incidents 2020 , natural phenomena were reported to affect only the digital infrastructure and the communication sector. About half of the incidents affecting the digital infrastructure sector (38 incidents – 9%) and one incident affecting the communication sector were reported as natural disasters. Regarding telecom security incidents in the EU reported in 2020 , natural phenomena come third as the root cause at almost a tenth of total incidents (9%, 109 incidents in total).

10.2 RECOMMENDATIONS

It is important to note that, since non-malicious threats are among the major threat vectors for any type of attack, mitigation vectors in this section might overlap with the ones in other chapters of this report. The following proposed

ENISA THREAT LANDSCAPE 2021

recommendations provide the basis for the development of a mitigation strategy for the prevention of and response to

non-malicious threats.

 Holistic approach to security must be adopted, where traditional security is enriched with physical protection

and disaster recovery.  Adopting a risk management process that considers non malicious threats, as well as cloud services.

 Avoiding shadow IT (and shadow IoT in particular) , coupled with good asset management.

 Continuous monitoring and testing to spot errors and misconfigurations in a timely manner.

 Organisational policies: while basic cyber practices are often lacking, attacks are becoming more

attacks driven by AI (e.g. deepfakes) can trigger a human error, which is very difficult to prevent in a wholly

technical way. Hence, robust organisational policies are needed to mitigate human errors.  Adopting a governance-based approach to data and security, allowing data to be thoroughly considered and

patched but means what is needed must be patched, eventually using priorities coming, for instance, from a

rather than only receiving them (i.e. software and hardware producers). There are many cases of IoT

vulnerabilities that have been around for years and it is difficult to understand who should actually publish the

 Training and awareness for all types of users. Properly trained developers can introduce many security and

safety practices into their products, leveraging modern languages and frameworks giving more security

guarantees. This is crucial also for developing secure IoT devices without some long-standing issues such as

those related to memory safety. Admins should be trained on the security (and compliance) aspects of

their activities, relying on solutions which ensure security by default. Finally, training and awareness are

fundamental for end users to help them, for instance, in recognising early signs of incidents and making the

management of utilities guaranteeing business continuity in case of unexpected events or shortages.  Zero-trust security approach, assuming everything is considered malicious and untrusted. This approach

moves from implicitly trusting assets because of their location or ownership towards a dynamic approach

ENISA THREAT LANDSCAPE 2021

where authentication and authorisation are explicitly granted, following the motto of ‘’identity is the new

perimeter’’  Increasing awareness at the level of top management that cybersecurity and physical security must be

integrated. Despite increasing physical attacks, corporate leaders are reluctant to believe their companies

could be physical threat targets.  Recovery plans and backups are fundamental to increasing system resilience.  Physical breaches can facilitate attacks. For instance, vulnerabilities in physical access control, tailgaters,

unattended devices can help an adversary in executing an attack.  Errors and malfunctioning in internal equipment (heating, ventilation, and air-conditioning) can bring on

scenarios in which fire, humidity and unstable power supplies can damage IT infrastructures.  Climate changes are posing a new set of challenges on system availability and resilience. Flooding, fire, and

earthquakes are happening at an increasing rate with an exponential power and impact on all

infrastructures. Risk assessment, disaster recovery techniques, and personnel training are fundamental.

ENISA THREAT LANDSCAPE 2021

A ANNEX: MITRE ATT&CK

RANSOMWARE

The figure illustrated below highlights the techniques in MITRE ATT&CK® Framework associated with ransomware software, ransomware groups or both according to the legend. Notice that this is a dynamic representation, based on actual observations. These can change over time as groups evolve and use new techniques. Every threat actor uses its specific tools and attack patterns. This overview groups all common techniques.

ENISA THREAT LANDSCAPE 2021 MALWARE

The term malware, or malicious software, covers a range of technology, tools, and tactics. Software is the interaction layer with information technology. This report focuses on malware in general, which we cannot unambiguously map to the ATT&CK Framework. Instead, malware is defined as a single building block of Capability Development. MITRE ATT&CK® describes malware as a means to support the threat actor’s operations, obtaining a means for maintaining control of remote machines, evading defences, and executing post-compromise behaviours. For illustration purposes, we describe the mapping to the MITRE ATT&CK® Framework concerning one notable malware, namely Emotet, which may be seen to be using a variety of different techniques in different stages.

Techniques used by EMOTET

ENISA THREAT LANDSCAPE 2021 ENISA THREAT LANDSCAPE 2021 BOTNET ENISA THREAT LANDSCAPE 2021 CRYPTOJACKING

The anatomy of cryptojacking related attacks is depicted in the following figure, which includes the techniques that may be used in each kill chain phase. The MITRE ATT&CK® Navigator view below highlights the common techniques associated with cryptojacking software and provides information regarding the behaviour of cyber adversaries and a taxonomy of adversarial actions.

E-MAIL RELATED THREATS

The anatomy of e-mail related attacks is depicted in the following table, which includes the techniques that may be used in each kill chain phase and lead to a phishing, spear-phishing, smishing, BEC or spam attack. The MITRE ATT&CK® provides information regarding the behaviour of cyber adversaries and a taxonomy of adversarial actions. The techniques leading to e-mail attacks are selected using the MITRE ATT&CK® for the Enterprise and Mobile domains which cover the behaviour against access to enterprise IT networks, cloud, and mobile devices, while focuses on the behaviour against network-based access on the Mobile domain.

PHISHING ENISA THREAT LANDSCAPE 2021 BEC ENISA THREAT LANDSCAPE 2021 THREATS AGAINST DATA

The anatomy of data exfiltration is depicted in the following table, which includes the techniques that may be used in each kill chain phase and lead to data exfiltration or data breach or identity theft. The construction of the table is based on the MITRE ATT&CK® knowledge base. MITRE ATT&CK® provides information regarding the behaviour of cyber adversaries and a taxonomy of adversarial actions. The techniques leading to data exfiltration were selected using the MITRE ATT&CK® part for Enterprise, which covers behaviours against enterprise IT networks and the cloud

DATA EXFILTRATION THREATS AGAINST AVAILABILITY AND INTEGRITY

The anatomy of Denial of Services attacks and web attacks are depicted in the following figures, which includes the techniques that may be used in each kill chain phase. The table is constructed based on the MITRE ATT&CK® knowledge base. MITRE ATT&CK® provides information regarding the behaviour of cyber adversaries and a taxonomy of adversarial actions. The techniques are selected using the MITRE ATT&CK® part for Enterprise, which covers behaviours against enterprise IT networks and the cloud.

DOS ENISA THREAT LANDSCAPE 2021 WEB BASED ATTACK

In 2021, the most widespread attack vector is UDP flooding (41.87%), while SYN flooding dropped to third place (26.36%), after TCP flooding (29.23%) . GRE (1.43%) and HTTP flooding (1.10%) showed modest growth. Linux botnets continued to account for almost all DDoS traffic (99.90%).

Web application security is a prime threat vector for both large and small organisations . F5 Labs classified DDoS attacks into three categories: volumetric, application, protocol, and analysed their frequency. 73% of all incidents was due to volumetric attacks; 53% of the attacks built on reflection attacks. For example, application DDoS includes HTTP, HTTPS, and DNS requests to a server. Volumetric DDoS includes standard UDP flooding, along with reflection attacks, including NTP and DNS.

DISINFORMATION - MISINFORMATION ENISA THREAT LANDSCAPE 2021 ENISA THREAT LANDSCAPE 2021

B ANNEX: MAJOR INCIDENTS

In what follows, we present a non-exhaustive list of relevant incidents, alongside their geographic spread/proximity and the associated timeline. It is important to note that by analysing the incidents presented as well as the full list of incidents related to threats mentioned in the ETL, ENISA determined the trends described in the previous sections.

The incidents that constitute each list were selected based on the following criteria: (a) the geographical spread of the attack, (b) the impact of the incident, (c) an innovative technique used for the attack, and (d) the existence of an unprecedented element (e.g. first incident in which a patient died because of a ransomware attack).

RANSOMWARE

Table 4: Notable ransomware incidents

Time Geographical Description Spread

ENISA THREAT LANDSCAPE 2021 ENISA THREAT LANDSCAPE 2021 MALWARE

Table 5. Notable malware incidents

Time Geographical Description Spread

ENISA THREAT LANDSCAPE 2021 CRYPTOJACKING

Table 6: Notable cryptojacking incidents

Time Geographical Description Spread

ENISA THREAT LANDSCAPE 2021 E-MAIL RELATED THREATS

Table 7: Notable incidents related to threats targeting e-mail

Time Geographical Description Spread

ENISA THREAT LANDSCAPE 2021 ENISA THREAT LANDSCAPE 2021 THREATS AGAINST DATA

Table 8: Notable incidents related to threats against data

Time Geographical Description Spread

ENISA THREAT LANDSCAPE 2021 ENISA THREAT LANDSCAPE 2021 THREATS AGAINST AVAILABILITY AND INTEGRITY

Table 9: Notable Denial of Service incidents

Time Geographical Description Spread

ENISA THREAT LANDSCAPE 2021 ENISA THREAT LANDSCAPE 2021

Table 10: Notable Web attacks

Time Geographical Description Spread

Web attacks on Government, Finance and Health domains

ENISA THREAT LANDSCAPE 2021 MINSINFORMATION AND DISINFORMATION

Table 11: Notable misinformation and disinformation incidents observed by ENISA (April 2020-July 2021)

Time Geographical Description Spread

ENISA THREAT LANDSCAPE 2021

Particular attention is given to incidents related to the pandemic, which found a sharp increase during the course of last year. Although not an incident per se, we also need to highlight that the World Health Organisation (WHO) declared an “infodemic” to describe the scale of fake news and its potential impact on efforts to limit the virus’s

spread. In general, COVID campaigns targeted three main themes: i) connection between vaccine and

neurological effects; ii) hidden target of global depopulation; iii) more effective medications than the vaccines. Accordingly, pandemic related misinformation/disinformation incidents are not exhaustively listed in the table below.

Table 12: Pandemic related misinformation/disinformation incidents

Time Geographical Description Spread

ENISA THREAT LANDSCAPE 2021 ENISA THREAT LANDSCAPE 2021 NON-MALICIOUS THREATS

Table 13: Notable incidents related to errors and misconfigurations made when managing an IT system

Time Geographical Description Spread

ENISA THREAT LANDSCAPE 2021

Table 14: Notable incidents related to errors and misconfigurations at application level

Time Geographical Description Spread

ENISA THREAT LANDSCAPE 2021

Table 15: Notable incidents related to errors and misconfigurations made during development

Time Geographical Description Spread

ENISA THREAT LANDSCAPE 2021

Table 16: Notable incidents caused by physical disasters

Time Geographical Description Spread

-N -EN -293 -21 -AE TP

ABOUT ENIS A

The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost the resilience of the Union’s infrastructure and, ultimately, to keep Europe’s society and citisens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu.

ISBN: 978-92-9204-536-4 DOI: 10.2824/324797 10.2824/32479710.2824/32 479710.2824/324797