ENISA Threat Landscape 2024

EUROPEAN UNION AGENCY FOR CYBERSECURITY

ENISA THREAT LANDSCAPE 2024

July 2023 to June 2024 SEPTEMBER 2024 ENISA THREAT LANDSCAPE 2024

ABOUT ENISA

The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency collaborates with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found at: www.enisa.europa.eu.

CONTACT

To contact the authors, please use etl@enisa.europa.eu For media enquiries about this paper, please use press@enisa.europa.eu

EDITORS

Ifigeneia Lella, Marianthi Theocharidou, Erika Magonara, Apostolos Malatras, Rossen Svetozarov Naydenov, Cosmin Ciobanu, Georgios Chatzichristos – European Union Agency for Cybersecurity

CONTRIBUTORS

Claudio Ardagna, Stephen Corbiaux, Koen Van Impe

ACKNOWLEDGEMENTS

We would like to thank the ENISA Advisory Group and the National Liaison Officers network for their valuable feedback, as well as ENISA colleagues Jamila Boutemeur and Johannes Clos for their invaluable review.

We would also like to thank the Information Integrity and Countering Foreign Information Manipulation and Interference Division (SG. STRAT.4) for sharing the data on information manipulation and revising and contributing to Chapter 9.

LEGAL NOTICE

This publication represents the views and interpretations of ENISA, unless stated otherwise. It does not endorse a regulatory obligation of ENISA or of ENISA bodies pursuant to the Regulation (EU) No 2019/881.

ENISA has the right to alter, update or remove the publication or any of its contents. It is intended for information purposes only and it must be accessible free of charge. All references to it or its use as a whole or partially must contain ENISA as its source.

Third-party sources are quoted as appropriate. ENISA is not responsible or liable for the content of the external sources including external websites referenced in this publication.

Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

ENISA maintains its intellectual property rights in relation to this publication.

ENISA THREAT LANDSCAPE 2024 COPYRIGHT NOTICE

© European Union Agency for Cybersecurity (ENISA), 2024

This publication is licenced under CC-BY 4.0 “Unless otherwise noted, the reuse of this document is authorised under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence (https://creativecommons.org/licenses/by/4.0/). This means that reuse is allowed, provided that appropriate credit is given and any changes are indicated”.

For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders.

ISBN: 978-92-9204-675-0, DOI: 10.2824/0710888

ENISA THREAT LANDSCAPE 2024 September 2024

TABLE OF CONTENTS

1. THREAT LANDSCAPE OVERVIEW 6 2. THREAT ACTOR TRENDS 20 3. VULNERABILITIES LANDSCAPE 34 4. RANSOMWARE 45 5. MALWARE 56 6. SOCIAL ENGINEERING 62 7. THREATS AGAINST DATA 69 8. THREATS AGAINST AVAILABILITY: DENIAL OF SERVICE 78 9. INFORMATION MANIPULATION AND INTERFERENCE 91 A ANNEX: MAPPING TO MITRE ATT&CK FRAMEWORK 101 B ANNEX: RECOMMENDATIONS 110 ENISA THREAT LANDSCAPE 2024

EXECUTIVE SUMMARY

Over time, the ETL has served as a crucial tool for comprehending the present state of cybersecurity within the European Union (EU), furnishing insights into trends and patterns. This, in turn, has guided pertinent decisions and prioritisation of actions and recommendations in the domain of cybersecurity.

Reporting over the course of 2023 and 2024, ETL highlights findings on the cybersecurity threat landscape during a yearlong geopolitical escalation. Throughout the latter part of 2023 and the initial half of 2024, there was a notable escalation in cybersecurity attacks, setting new benchmarks in both the variety and number of incidents, as well as their consequences. The ongoing regional conflicts still remain a significant factor shaping the cybersecurity landscape. The phenomenon of hacktivism has seen steady expansion, with major events taking place (e.g. European Elections) providing the motivation for increased hacktivist activity.

7 prime cybersecurity threats were identified, with threats against availability topping the chart and followed by ransomware and threats against data, and the report provides a relevant deepdive on each one of them by analysing several thousand publicly reported cybersecurity incidents and events:

• Ransomware • Malware • Social Engineering • Threats against data • Threats against availability: Denial of Service • Information manipulation and interference • Supply chain attacks

The report is complemented by a detailed analysis of the vulnerability landscape during 2023 and 2024, as well as a detailed analysis of four distinct threat actors’ categories, namely:

• State-nexus actors; • Cybercrime actors and hacker-for-hire actors; • Private Sector Offensive actors (PSOA); • Hacktivists.

With 2024 being the year that NIS2 Directive comes into force, an analysis of the cybersecurity threat landscape across different sectors is provided. Notably, we have again observed a large number of events targeting organisations in the public administration (19%), transport (11%) and finance (9%) sectors.

The key findings and judgments in this assessment are based on multiple and publicly available resources. The report is mainly targeted at strategic decision-makers and policy-makers, while also being of interest to the technical cybersecurity community.

ENISA THREAT LANDSCAPE 2024 ENISA THREAT LANDSCAPE 2024

1. THREAT LANDSCAPE OVERVIEW

In its twelfth edition, the ENISA Threat Landscape (ETL) report offers a broad overview of the cybersecurity threat landscape. Over time, the ETL has served as a crucial tool for comprehending the present state of cybersecurity within the European Union (EU), furnishing insights into trends and patterns. This, in turn, has guided pertinent decisions and prioritisation of actions and recommendations. The ETL report combines strategic and technical elements, catering to both technical and non-technical audiences. The ETL 2024 report has been validated and supported by the ENISA Advisory Group and the ENISA National Liaison Officers (NLO) Network.

Throughout the latter part of 2023 and the initial half of 2024, there was a notable escalation in cybersecurity attacks, setting new benchmarks in both the variety and number of incidents, as well as their consequences. The ongoing regional conflicts still remain a significant factor shaping the cybersecurity landscape. The phenomenon of hacktivism has seen steady expansion, marked by the emergence of numerous new groups. Major events taking place at a national or European level provided the motivation for increased hacktivist activity during the reporting period (e.g. European Elections).

The ETL 2024 report follows the same customary approach, drawing on diverse open-source data and cyber threat intelligence sources. It pinpoints significant threats, discerns emerging trends and offers practical high-level strategies for mitigating risk. This year's ETL continues to use the officially endorsed ENISA Cyber Security Threat Landscape Methodology , which was released in 2022. The ENISA CTL Methodology serves as a foundational framework for the transparent and systematic creation of comprehensive cybersecurity threat landscapes, spanning horizontal, thematic and sector-specific perspectives. This process is characterised by rigorous data collection and analysis procedures.

1.1 METHODOLOGY

The ENISA Cybersecurity Threat Landscape (CTL) methodology was used to produce the ETL 2024 report. The methodology was published in July 2022.

The ENISA Threat Landscape (ETL) 2024 report is based on information from open sources, mainly of a strategic nature and ENISA’s own Cyber Threat Intelligence (CTI) capabilities. It covers more than one sector, technology and context. The report aims to be industry and vendor agnostic. It references or cites the work of various security researchers, security blogs and news media articles throughout the text in multiple footnotes to validate findings and statements. The time span of the ETL 2024 report is July 2023 to June 2024 and is referred to as the 'reporting period' throughout the report.

During the reporting period, ENISA gathered a list of major incidents as they appeared in open sources through situational awareness. This list serves as the foundation for identifying the list of prime threats and the source material for several trends and statistics in the report.

ENISA THREAT LANDSCAPE 2024

Subsequently, an in-depth desk research of available literature from open sources such as news media articles, expert opinion, intelligence reports, incident analysis and security research reports were conducted by ENISA and external experts. Note that many intelligence and research reports are written on the basis of a January to December year, contrary to the ETL’s reporting period which is from July to June. Through continuous analysis, ENISA derived trends and points of interest. The key findings and assessments are based on multiple and publicly available resources which are provided in the references used for the development of this document.

Within the report, we differentiate between what has been reported by our sources and what is our assessment. When conducting an assessment, we convey probability by using words that express an estimate of likelihood .

When we refer to threat actors in this report, we use the naming convention used by the company revealing the campaign, as well as a number of aliases commonly used in the industry.

1.2 PRIME THREATS

According to the findings detailed in this report, the ENISA Threat Landscape 2024 report highlights and directs attention toward eight prime threat types (see Figure 1). These particular threat types have been singled out due to their prominence over the years, their widespread occurrence and the significant impact resulting from the realisation of these threats.

• Ransomware

According to ENISA’s Threat Landscape for Ransomware Attacks report, ransomware is defined as a type of attack where threat actors take control of a target’s assets and demand a ransom in exchange for the return of the asset’s availability or in exchange for publicly exposing the target’s data. This definition is needed to cover the changing ransomware threat landscape, the prevalence of multiple extortion techniques and the various goals, other than solely financial gains, of the perpetrators. Ransomware has been, once again, one of the prime threats during the reporting period, with several high profile and highly publicised incidents.

• Malware

Malware, also referred to as malicious code and malicious logic, is an overarching term used to describe any software or firmware intended to perform an unauthorised process that will have an adverse impact on the confidentiality, integrity or availability of a system.

• Social Engineering

Social engineering encompasses a broad range of activities that attempt to exploit human error or human behaviour with the objective of gaining access to information or services. It uses various forms of manipulation to trick victims into making mistakes or handing over sensitive or secret information. Users may be lured to open documents, files or e-mails, to visit websites or to grant access to systems or services. Although the lures and tricks used may abuse technology, they rely on a human element to be successful. This threat canvas consists mainly of the following attack vectors: phishing, spear-phishing, whaling, smishing, vishing, watering hole attack, baiting, pretexting, quid pro quo, honeytraps and scareware. While social engineering techniques are often used to gain initial access, they may also be

ENISA THREAT LANDSCAPE 2024

used at later stages in an incident or breach. Notable examples are business e-mail compromise (BEC) , fraud, impersonation, counterfeit and, more recently, extortion.

• Threats against data

A data breach is defined in the GDPR as any breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorised disclosure of or access to personal data transmitted, stored or otherwise processed (article 4.12 GDPR). Technically speaking, threats against data can be broadly classified as data breach or data leak. Though often used as interchangeably, they entail fundamentally different concepts that mostly lie in how 7 8 they happen .

Data breach is an intentional cyber-attack brought by a cybercriminal with the goal of gaining to unauthorised access and release sensitive, confidential or protected data. In other words, a data breach is a deliberate attack against a system or organisation with the intention of stealing data. Data leak is an event (such as misconfigurations, vulnerabilities or human errors) that can cause the unintentional loss or exposure of sensitive, confidential or protected data (intentional attacks are sometimes referred to as data exposure).

• Threats against availability: Denial of Service

DDoS targets system and data availability and, though it is not a new threat, it plays a 9 10 significant role in the cybersecurity threat landscape . Attacks occur when users of a system or service are not able to access relevant data, services or other resources. This can be accomplished by exhausting the service and its resources or overloading the components of the network infrastructure .The impact of DDoS attacks is often limited and symbolic

• Information Manipulation

Foreign Information Manipulation and Interference (FIMI) describes a mostly non-illegal pattern of behaviour that threatens or has the potential to negatively impact values, procedures and political processes. Such activity is manipulative in character, conducted in an intentional and coordinated manner. FIMI can be carried out by state or non-state actors, including their proxies inside and outside their own territory; in this report we study the threat regardless of its origin.

It should be noted that the aforementioned threats involve categories and refer to collections of diverse types of threats that have been consolidated into the seven areas mentioned above. Each of the threat categories is further analysed in a dedicated chapter in this report with the exception of the supply chain, which elaborates on its particularities and provides more specific information on findings, trends, attack techniques and mitigation vectors.

ENISA THREAT LANDSCAPE 2024

Figure 1: ENISA Threat Landscape 2024 - Prime threats

In the following figure it can be seen that for another year ransomware and DDoS attacks were the most reported forms of attacks during the reporting period and accounted for more than half of the observed events followed by threats related to data. In several cases incidents involved more than one threat category and were thus analysed in the context of all respective categories. Given that the ETL is based on publicly available information and the fact that such information might not always provide the full picture, in certain cases incidents could not be classified into any threat category.

Figure 2: Breakdown of analysed incidents by threat type (July 2023 till June 2024)

ENISA THREAT LANDSCAPE 2024 1.3 KEY TRENDS

The list below summarises the main trends observed in the cyber threat landscape during the reporting period. Further details and analysis of the trends may be found throughout the various chapters that comprise the ENISA threat landscape of 2024.

• Threats against availability (DDoS) and Ransomware ranked at the top during the

reporting period for another year.

• Living Off Trusted Sites (LOTS): Threat actors extended their stealth techniques into the cloud, using trusted sites and legitimate services to avoid detection and disguising Command and Control communications (C2) as ordinary traffic or innocuous messages on platforms like Slack and Telegram. • Geopolitics continued to be a strong driver for cyber malicious operations. • Advancements in defensive evasion techniques: Cybercrime groups, especially ransomware operators, evaded detection by using Living Off The Land (LOTL) techniques. to blend into environments and mask their malicious activities. 13 14 15 • There has seen a sharp increase in Business Email Compromise (BEC) incidents • Extortion by weaponizing disclosure requirements, pushing companies to fulfil extortion demands ahead of the required reporting deadline. • Ransomware attacks appear to have stabilized in quite high numbers in regards

to the previous reporting period

• Ever more impactful law enforcement operations, such as Operation Chronos and Operation Endgame. • AI tools for cyber criminals: Threat actors used tools such as FraudGPT and large language models to co-author scam emails and generate malicious PowerShell scripts. • 19,754 vulnerabilities were identified with 9.3% fell into the ‘critical’ category and 21.8% were categorised as ‘high’. • Information stealers continue to be heavily used by threat actors: Due to the popularity of IABs and downloaders. Information stealers are now essential components in attack chains. • Hacktivists overlapping their activities with State-nexus actors: A notable trend is the increasing similarity between State-nexus actors and alleged hacktivist activities. • Data leak site have started being considered to be unreliable. Many of the data leaks posted are duplicates of previous attacks or wrongly attributed to the Lockbit ransomware group. This follows the disruption of their operations by Operation Chronos. • Recent surge in mobile banking trojans has been observed, with a concomitant increase in the complexity of their attack vectors. • Malware-as-a-Service (MaaS) offerings continued to be a significant and rapidly evolving threat, particularly since mid-2023. • Supply chain compromises through social engineering are emerging: for example, in March 2024, backdoor code was introduced in an open-source project XZ Utils, a set of tools and libraries used for data compression . • Data compromise increased in 2023-2024. There was a rise in data compromises leading up to 2021 and although this trend remained relatively stable in 2022, it began to increase once more in 2023 and showed signs of maintaining this momentum in 2024. • DDoS-for-Hire allows large-scale attacks to be launched by unskilled users having access to DDoS services. • Information manipulation continues to be a key element of Russia’s war of aggression against Ukraine, although an effort to further localise content and, at the

ENISA THREAT LANDSCAPE 2024

same time, to globalise its presence is observed. Manipulating information in response of specific news seems to have increased, probably because 2024 has been marked by many major events, elections in particular. • The threat of AI-enabled information manipulation has been observed, but still on a limited -albeit evolving - scale. For example, some threat actors are experimenting with AI for information manipulation seemingly to assess how AI can be exploited in this context.

1.4 EU PRIME THREATS

Cyber-attacks continue to increase on the global scale; however, ENISA’s scope is primarily focused on EU member states and thus more emphasis is placed on the landscape within the EU.

Figure 3 shows a significant increase in events in the EU in the first half of 2024 compared to the second half of 2023, though on a global scale (non-EU) the spread seems to be more even. It's important to recognise that the observed number of events can be influenced by various factors. An increase in reported cyber-attacks doesn't necessarily indicate an actual rise in the number or severity of attacks. This surge could be due to heightened media or public attention to specific events, leading to more incidents being documented in open-source intelligence (OSINT) channels, or threat actors claiming victims with no real impact on those victims.

Figure 3: Break down of Global and EU events (July 2023 – June 2024)

Throughout the reporting period, EU Member States continued to be affected by ongoing geopolitical crises, with a growing number of threat actors directing their efforts against both public and private organisations. These kinds of events more often fall under the DDoS threat (chapter 2, section 4, and chapter 7) with little to no impact in most of the cases reported through OSINT. Ransomware attacks have shown a decrease (chapter 4) in the EU.

ENISA THREAT LANDSCAPE 2024

ENISA observed 11,079 incidents, including 322 incidents specifically targeting two or

more EU Member States (labelled ‘EU’) as it can be seen in Figure 4 which shows a timeline of when the events where first reported through open-source channels. In addition, throughout this iteration of the ETL it can be seen that ransomware and DDoS still remained the two prime threats for the EU as shown in Figure 5.

Figure 4: Timeline of EU events (count of number of observed incidents a month)

Figure 5: EU breakdown of number of threats by threat group

1.5 SUPPLY CHAIN

Supply chain attacks has become a threat on a horizontal level touching upon multiple of the other threats. The reason why for this year it was decided not to have a separate chapter even 12

ENISA THREAT LANDSCAPE 2024

though was that few incidents were reported to be of a supply chain attack. This does not mean that we did not have incidents just that maybe they were not reported publicly as being or affecting supply chains.

One of the most controversial incidents during the reporting period was of the incident with 3CX which offered a glimpse into the potentials threats we face. In March 2024, backdoor code was introduced in an open-source project XZ Utils , a set of tools and libraries used for data compression. Luckily, the vulnerability was discovered by a software engineer who investigated CPU spikes resulting from the backdoor. The vulnerability was considered critical, as it allowed for easy remote code execution through SSH. This was possible as the malicious actor was made maintainer of the project after a long-lasting social engineering campaign.

The account creation dates to 2021, and the user’s first code commit in the project was pushed in 2022. In that period, different (but as it would later seem, connected) accounts started pressuring the original maintainer, accusing him of standing in the way of the project’s advancement, suggesting that he would start giving over the reigns over the project. In January, the threat actor took over as primary contact over the project. Over 2023 and 2024, different steps were then performed to prepare the environment and eventually push the backdoor.

In a similar case the OpenJS Foundation received a suspicious series of emails with similar messages, bearing different names and overlapping GitHub-associated emails, asking OpenJS to take action to update one of its popular JavaScript projects to “address any critical vulnerabilities,”. They also requested OpenJS to designate them as a new maintainer of the project despite having almost no prior involvement. The Open Source Security (OpenSSF) and OpenJS Foundations called out all open source maintainers to be alert for social engineering takeover attempts, to recognize the early threat patterns emerging, and to take steps to protect their open source projects.

Recent public reports also have highlighted a general high interest , primarily from North Korean-nexus groups , characterised by more aggressive and expansive intrusions across 23 24 multiple networks. There has also been a focus on attacks that target update mechanisms 25 26 27 or compromise the open-source software supply chain. Such attacks involve name or repository confusion, tricking developers into using compromised software, or embedding malware in test files. A notable instance involved the introduction of a backdoor in XZ Utils. The sophistication, meticulous planning, and duration of this campaign suggest the involvement of a well-resourced actor, although specific attribution remains unclear at this time. Build systems 28 29 became a popular target as well for groups associated with Russia and North Korea, but primarily due to vulnerabilities in publicly accessible systems.

ENISA THREAT LANDSCAPE 2024

Finally, out of the observed events that ENISA collected, the following ones affected sectors that offer services and products to other sectors: Digital infrastructure (8%), manufacturing (6%) business services (8%), energy (3%) and ICT service management (3%).

1.6 SECTORIAL ANALYSIS

Cyber threats are indiscriminate, impacting a wide range of industries and sectors. This is a direct consequence of our hyper-connected digital world. As the following figures illustrate, threat actors target every sector, highlighting the universal nature of cyber risk.

The sectors analysed in this report follow, in general, the classification of the sector categories in the Network and Information Security Directive (NIS2) . There are however some deviations, derived by the samples used, as the report may include events affecting sectors beyond the scope of the NIS2 directive. Examples include defence, education , media and entertainment, retail and more. We have also grouped under the term ‘Digital service provider’, the sectors listed in NIS2 as ICT service management (MSPs and MSSPs) and digital providers. There is also a separate category, labelled as ‘all sectors’ which is used when events have an effect across sectors. During the analysis, other sectors were identified that are not currently within the scope of the NIS2 directive, such as consulting, legal, and hospitality services etc, which are grouped under the category ‘Services’.

Figure 6 Targeted sectors per number of incidents (July 2023 - June 2024)

During this reporting period in the overall global landscape, we have again observed a large number of events (Figure 6) targeting organisations in the public administration (19%), transport (11%) and finance (9%) sectors. Events targeting digital infrastructure (8%) and business services form a substantial portion of the events observed. We also observed a considerable number of events targeting civil society and not necessarily a particular sector (these are

ENISA THREAT LANDSCAPE 2024

labelled as ‘General Public’ and amount to 8% of the events observed). They consist of social engineering or information manipulation campaigns.

The prime threat was DDoS and it appears to target the entire range of the sectors (Figure 7). The most targeted sectors were public administration (33% out of DDoS events), transport (21% out of DDoS events), banking (12% out of DDoS events) and digital infrastructure (6% out of DDoS events).

These are followed by ransomware attacks and data-related threats. Ransomware appears to target different sectors indiscriminately during this reporting period, with Business services (18% out of ransomware events), Manufacturing (17% out of ransomware events) and Health (8% out of ransomware events) being more affected. Data related threats targeted all sectors, with the ones that hold personal information being more affected. Out of data related events, these affected general public (15%), public administration (12%), digital infrastructure (10%), finance (9%) and business services (8%).

29% of the events involving malware affected the general public, followed by malware infections in digital infrastructure (25%) and in public administration (11%). 9% of observed malware events affects all sectors.

Out of the observed events related to social engineering, 28% focused on the general public, followed by digital infrastructure (15%), public administration (10%) and finance (10%) sectors. Likewise, information manipulation campaigns targeted general public in most of the collected events.

Figure 7: Observed events related to prime ETL threats in terms of the affected sectors

More information on how each sector is affected during the reporting can be found in the following figure.

ENISA THREAT LANDSCAPE 2024

Figure 8: ETL threats per sector

In the breakdown of the top 20 ‘active’ threat actors during the reporting period, the trend that actors are often sector-agnostic becomes evident once more, as nearly all of them are dispersed across various sectors. Similarly to 2023, public administration and transport remains a preference by the active Hacktivists groups.

Figure 9 Threat actor per sector

ENISA THREAT LANDSCAPE 2024 1.7 MOTIVATION

Understanding the enemy and the motivation behind a cybersecurity incident or targeted attack is important because it can determine what an adversary is after. Assessing the motives provides an idea of the intentions of attackers and helps entities focus their efforts in defence on the most likely attack scenario for any particular asset.

For the third year ETL 2024 includes an assessment of the motivation behind the incidents observed during the reporting period. For this purpose, five distinct kinds of motivation that can be linked to threat actors have been defined:

• Financial gain: any financially related action (carried out mostly by cybercrime groups); • Espionage: gaining information on IP (intellectual property), sensitive data, classified data (mostly executed by state-sponsored groups); • Destruction: any destructive action that could have irreversible consequences; • Ideological: any action backed up with an ideology behind it (such as hacktivism).

It is apparent that in the majority of cases the primary threats can be attributed to one or more motivations, with certain motivations emerging as more dominant than others. As with the previous iteration within the realm of Ransomware attacks, while the primary motivation typically revolves around financial gain, there is a small percentage where a disruptive motive also plays a role.

Following financial gain as the top motivation, disruption was the second most common motive, primarily due to the prevalence of DDoS attacks during the reporting period. These disruptive attacks were aimed at causing operational downtime.

Figure 10: Motivation of threat actors per threat category

Additionally, most data-related threats were linked to multiple motivations, with financial gain being the primary driver. Ideology and espionage also played significant roles, as attackers sought to advance specific agendas or exfiltrate strategic information. This highlights the 17

ENISA THREAT LANDSCAPE 2024

diverse motivations behind cyber threats, ranging from financial incentives to ideological and intelligence-gathering objectives.

For a considerable number of the events we have gathered, the motivation remains unclear. This lack of clarity could be due to either limited or undisclosed information or the victims themselves being unaware of the underlying motive.

1.8 STRUCTURE OF THE REPORT

The ENISA Threat Landscape (ETL) 2024 has maintained the core structure of previous ETL reports for highlighting the prime cybersecurity threats in 2023. Those familiar with previous versions will observe that the current editions now incorporate the CVE landscape within chapters that offer an overview of the most significant CVEs identified during the reporting period. ENISA considers this inclusion to be crucial because it sheds light on yet another facet of what threat actors can exploit, as highlighted in Chapter 3. This addition also underscores the significance of vulnerability disclosure and timely patching.

This report is structured as follows:

Chapter 2 explores the trends related to threat actors (i.e., state-nexus groups, cybercrime actors, Private Sector Offensive Actors (PSOA) and hacktivists); Chapter 3 includes a CVE landscape, as observed during the reporting period; Chapter 4 discusses major findings, incidents and trends regarding ransomware; Chapter 5 presents major findings, incidents and trends regarding malware; Chapter 6 describes major findings, incidents and trends regarding social engineering; Chapter 7 highlights major findings, incidents and trends regarding threats against data (data breach, data leak); Chapter 8 discusses major findings, incidents and trends regarding threats against availability (denial of service); Chapter 9 underlines the importance of hybrid threats and describes major findings, incidents and trends regarding information manipulation; Annex A presents the techniques commonly used for each threat, based on the MITRE ATT&CK® framework; Annex B presents recommendations and security controls that might add to the mitigation of the threats.

ENISA THREAT LANDSCAPE 2024 ENISA THREAT LANDSCAPE 2024

2. THREAT ACTOR TRENDS

Cyber threat actors are an integral component of the threat landscape. They are entities carrying out malicious activities. Understanding how threat actors’s assessed objectives and Tactis, Techniques and Procedures (TTPs) is essential for a more robust cyber threat management and incident response.

In this section, we explore the trends related to threat actors. This assessment does not provide an exhaustive list of all trends during the reporting period but rather a overview of the significant trends observed at a strategic level. We focus on the motives of threat actors, their impact, and targeting. Their evolution is also assessed. For the ETL 2024, we consider once more the following four categories of cybersecurity threat actors:

• State-nexus actors; • Cybercrime actors and hacker-for-hire actors ; • Private Sector Offensive actors (PSOA); • Hacktivists.

State-nexus actors, are in general well-funded, resourced and advanced. Their objective is primarily espionage and disruption, sometimes directed by the military, intelligence or state control apparatus of their country. And although the techniques they employ might not always be that novel, their motivation and planning allow them to execute advanced, large-scale or targeted and long-term operations. State-nexus actors often spend considerable time investigating their targets to identify weaknesses and entry points and they focus on avoiding operational mistakes. State-nexus actors do not only target other states. They can as well target other organisations for sensitive data or conduct operations to obtain funding for their country.

The objective of cybercrime actors is financial gain or profits in general. Their attacks are opportunistic and indiscriminate and they target the data or infrastructure that has the highest impact on the operations of victims. They can either steal directly from victims, can extort the victim or can monetise the information stolen from victims. Cybercrime actors often use social engineering and employ multiple different methods for monetising their access into organisations. In addition, cybercrime actors have shown an increased level of collaboration and professionalisation, making them a force with which to be reckoned.

Under cybercrime actors we can also observe the hacker-for-hire actors which contribute to the professionalisation of the cybercrime market, but also provide services to State-nexus actors. The hacker-for-hire actors can lower the barrier to get access to the criminal market, such as for example with ransomware-as-a-service or RaaS. They also play a key role in the market that thrives on selling access to environments (so called Initial Access Brokers or IAB), either because the threat actor is tasked or because of opportunistic reasons. The hacker-forhire threat actor is also available for vulnerability research and exploitation.

In regards to Private Sector Offensive Actors (PSOAs), are commercial entities that engage in the cyber-surveillance industry. They specialize in developing and selling cyberweapons, including "zero-day" exploits and malicious software, to a variety of clients, often governments and private individuals. They are a growing concern in the cybersecurity landscape due to their ability to provide advanced cyber capabilities to a wide range of clients, potentially leading to serious consequences for individuals, organizations, and societies.

ENISA THREAT LANDSCAPE 2024

Lastly, we cover the hacktivists. Hacktivists are not as well-resourced as the other threat actors but are often fuelled by strong motivations. Their objectives often involve disruption and they use hacking to affect some form of political or social change. The hacktivists groups are very diverse and vary heavily in skillsets and capabilities. The hacktivists threat actors are sometimes also leveraged by State-nexus actors for influence operations or other forms of intrusion campaigns.

As an attentive reader you probably noticed we did not include the insider threat actor as one of the prime threat actors in this ETL. We excluded this threat actor because of the very low number of public reporting of incidents . Despite the fact that there are programs that highlight the need 3334 to focus on insider threat mitigation , organisations remain reluctant in sharing details of these incidents. This does not imply that the risk of a malicious insider is deemed of lesser significance. On the contrary, insiders remain an efficient way for gaining access to the internals of an organisation, and as such they are sometimes used -knowingly or unknowingly- by Statenexus or cybercrime actors for initial access into a victim’s environment. It is relevant to highlight that human errors or carelessness constitute a portion of incidents considered as ‘insider threats’.

Over the course of the reporting period, we have pinpointed the 25 most active threat actors overall from the data we collected. It is worth highlighting that a significant majority of the events we gathered have not been attributed to any specific threat actor, which underscores the challenges associated with accurate political attribution. Hacktivist group NoName057 has also been very active during the reporting period followed by the ransomware group Cl0p.

Figure 11: 25 Most active Threat actors during the reporting period

2.1 STATE-NEXUS GROUP TRENDS Avoiding detection at all costs ENISA THREAT LANDSCAPE 2024

One of the most significant trends observed in campaigns of State-nexus threat actors are their methods to avoid detection and sidestepping organisational defences. They increasingly 36 37 38 employ Living Off the Land (LOTL) techniques to minimise their footprint and rely on remote monitoring and management (RMM) software. Although these techniques have been noted in previous reports, they have now surged to the forefront of prominent trends. Moreover, State-nexus actors are cleverly utilising tools that are ubiquitous across nearly all environments: security tools and their control panels. This not only facilitates stealthy malware deployment and lateral movements but also enables them to harvest detailed insights into an organisation’s infrastructural vulnerabilities, all without raising much suspicion.

In general, State-nexus threat actors have always been increasingly adept at understanding the environments they infiltrate. They strategically deploy tools and take their time to conduct thorough reconnaissance and skilfully prevent the detection and analysis of their implants by 41 42 43 44 employing robust anti-forensic measures. Predominantly, actors from Russia and Iran continue to deploy disruptive malware such as wipers not only to wreak havoc but also as an extremely effective method to cover their tracks. Given the effectiveness of these techniques and the significant advancements in the detection and response capabilities of organisations, it is very likely that State-nexus actors will further intensify their use of these strategies.

The effort to remain undetected, while simultaneously complicating attribution, is also evident in the operational infrastructure of threat actors, where they employ a mix of self-registered and compromised infrastructure. This infrastructure is not only shared among various groups but is also used by both State-nexus and cybercrime actors. To further obfuscate their activities, they are increasingly adopting network anonymising techniques such as commercial VPNs, TOR, and proxy software. Moreover, there's a marked increase in the use of compromised devices within residential networks, often orchestrating them into botnets . China-nexus actors especially relied on a mix of self-registered and compromised networks, referred to as Operational Relay Box (ORB) networks.

The broad adoption introduces new complexities for defenders, including the increased ephemerality and temporality of indicators. We expect this trend in operational infrastructure, predominately undertaken by China and Russia-nexus groups, is likely to continue in the coming years.

Leveraging cloud services for stealth and strategy

The theme of stealth extends into the cloud, where State-nexus actors use trusted sites and legitimate cloud services to evade detection, so called Living Off Trusted Sites (LOTS). They

ENISA THREAT LANDSCAPE 2024

disguise command and control communications (C2) as ordinary Microsoft traffic or as

innocuous messages to platforms like Slack and Telegram. Services such as Google Drive

and OneDrive are exploited for data exfiltration and malware storage. GitHub has become a particular favourite, serving as a hub for payload delivery, acting as a dead drop, command and control communication, and for facilitating data exfiltration. These actors are increasingly harnessing API services to achieve their objectives, including reconnaissance and data

exfiltration, making use of free APIs like mockbin.org and mocky.io. Groups linked to Russia

and Iran have shown an interest in APIs associated with Microsoft services , such as the Microsoft Graph API.

State-nexus actors have not confined themselves to merely using cloud services for evasive

manoeuvres; they also directly target these services on two levels: by compromising hosts within a cloud tenant and by targeting identities associated with cloud infrastructure.

Targeting identities

It is hardly surprising that State-nexus actors maintain a keen interest in attacks targeting

identities and credentials. They harness credentials from previous breaches, employ password spraying and brute force attacks, or reactivate dormant accounts. When direct access

to credentials is not at hand, these actors resort to social engineering tactics. Phishing remains their preferred method, while refining their strategies by leveraging social media, Microsoft Teams, compromised tenants and popular email marketing platforms. To circumvent

corporate defences, they increasingly turn to social media and communication platforms such as WhatsApp or LinkedIn. Personal accounts, typically less secure than corporate ones, are especially vulnerable. We also observed an increase in targeting precision, sometimes via geofencing or web beacons, and it is likely this approach will further continue.

Exploiting vulnerabilities and edge devices

Exploiting vulnerabilities remains a favoured tactic for State-nexus actors to infiltrate organisations. As end-user platform vendors invest significantly in security, attackers shift their

focus to other environments, highlighting the impact of these investments. However, this does

not mean end-user platforms are off the radar. Vulnerabilities in software such as Outlook, continue to be exploited for executing arbitrary code. In general, the number of known

ENISA THREAT LANDSCAPE 2024

vulnerabilities is increasing, as shown in chapter 3. Although this doesn't precisely track zeroday exploits, it still serves as a valuable indicator of trends. Chinese groups lead the charge in

exploiting vulnerabilities, heavily investing in zero-day exploits and occasionally collaborating with commercial surveillance vendors to enhance their capabilities.

Edge devices, used for networking and security, remain a lucrative entry point. Access via

these devices is popular because of security on the many number of issues found in these devices, and devices often rely on legacy components. Additionally, the lack of security monitoring makes them easy prey. Products such as Ivanti Connect Secure, Cisco or FortiGate

were prime targets for State-nexus activity. Actors also anticipate remediation efforts and

create tools to remain embedded in high-value targets by installing backdoors on routers or

modifying firmware . Virtualisation technology and hypervisors, remain lucrative targets as well. Public applications continue to be a prime target for actors operating in the interests of

China, North Korea, and Iran. Their main focus includes web applications such as ecommerce platforms, collaboration tools and service desk software, alongside lingering

vulnerabilities in Log4J, and SQL and Java applications. A notable example is the exploitation of RMM software, such as ScreenConnect, which has become a feast for both State-nexus actors and cybercriminals. Another notable example was the COATHANGERcampaign were State-nexus actors exploited vulnerability affecting FortiGate devices to conduct

espionage activities .

Given the sheer volume of vulnerabilities and the challenges vendors face in addressing them, coupled with the complexity for large organisations to organise timely patching, it is highly likely that exploiting vulnerabilities will continue to be one of the main entry points for State-nexus actors.

Misinformation, disinformation and foreign interference

The sharp rise in reported misinformation and disinformation campaigns is

concerning. The role of technology in these campaigns remains highly significant , as

ENISA THREAT LANDSCAPE 2024

many are amplified through social media platforms like X, Facebook, and video hosting services such as Instagram, TikTok, and YouTube. Additionally, broadcasted real-time bidding

(RTB) data provides opportunities for State-nexus actors to target key individuals. While social media platforms have begun addressing these issues, sometimes reluctantly, there is still a

substantial amount of work to be done. Notable campaigns were Doppelgänger and Portal

Kombat (in favour of Russia) and PAPERWALL (in favour of China).

As campaigns linked to geopolitical events continue to evolve, along with an increase in social engineering, it is almost certain that State-nexus actors will further expand this trend as an effective means to further achieve their objectives.

Threat actors leveraging artificial intelligence as an assistant

Recent observations reveal that large language models (LLMs) such as ChatGPT are employed by Russian, North Korean, Iranian, and Chinese State-nexus groups. They use AI for a variety of malicious activities including scripting and phishing assistance, vulnerability research and target reconnaissance. The principal danger lies not in entirely new risks, but

rather in AI's capacity to enhance existing techniques, allowing for the massive distribution of fake, targeted narratives, including social media posts, articles, memes, and photos. We have

already witnessed its capabilities with doctored recordings of a candidate alleging election

rigging or endorsing another presidential candidate.

2.2 CYBERCRIME ACTOR TRENDS Advances in defensive evasion techniques

Cybercrime groups refined their evasion techniques to blend seamlessly into environments.

These criminals, for the most part ransomware operators, use Living Off The Land (LOTL)

strategies and rely on remote monitoring and management (RMM) software such as AnyDesk and Atera to mask their activities. In their efforts to blend in, the adoption of commodity tools, dual-use software, and open-source software remains significant. They

predominantly use Cobalt Strike, Viper, BloodHound, and Impacket. The emergence of

ENISA THREAT LANDSCAPE 2024

AzureHound, Pacu, and CloudFox underscores a growing trend towards exploiting cloud 110 111 112 services. Popular open-source software was

It is very likely that cybercriminals will further continue to expand their use of these techniques to evade defensive measures.

Anonymisation networks to hide traffic

Continuing with the theme of stealth, cybercriminals used anonymisation networks and large 118 119 botnets composed of compromised residential devices. These botnets are frequently used for DDoS attacks, cryptocurrency mining, and malware distribution.

Often, multiple groups compromise these devices, leading to situations within the network 121 122 123 infrastructure. The use of proxyware networks is further expanding and incorporating mobile devices and macOS systems. While these networks serve legitimate purposes, there is an increasing trend in their misuse for malicious and illegal activities.

Zero-day and one-day vulnerabilities

As way of easy entry into organisations, financially motivated actors increasingly relied on 124 125 exploiting zero-day and one-day vulnerabilities to infiltrate systems and steal valuable data. While zero-day vulnerabilities pose a significant threat, cybercriminals often focus on a smaller subset of one-day vulnerabilities. This preference stems from the established attack paths of oneday vulnerabilities and the relative shortage of zero-days either for sale on cybercrime forums or in general announced by vendors or found by researchers. This trend underscores that effective and prioritised patching could be likely to prevent a large number of incidents or at least make them considerably more challenging to execute. However, numerous challenges still hinder organisations and suppliers from achieving this level of security.

ENISA THREAT LANDSCAPE 2024

A persistent trend is the exploitation of vulnerabilities in internet-facing services such as web management systems, firewalls, VPNs and routers. Noteworthy examples include

vulnerabilities in Ivanti Connect Secure, NetScaler, Fortinet devices and older issues in MOVEit. Additionally, misconfigured services, such as unintentionally exposed Redis services

or exploitable Remote Desktop Protocol (RDP), continue to present significant risks.

In the context of internet-connected devices, it's relevant to note that, as of April, suppliers in the

UK are prohibited from providing devices with easy guessable default passwords. This change is likely to have a positive impact on markets outside the UK as well.

Changes in social engineering

Identity compromises and the misuse of valid credentials are nearly ubiquitous in today’s threat landscape. Alongside exploiting vulnerabilities, criminals prefer this malware-free access

method , exploiting the increase in stolen data, often sourced from information stealers.

When direct breaches fail to yield credentials, they turn to traditional brute-force tactics such as password spraying and credential stuffing or exploit easily guessable passwords. Moreover,

the misuse of cloud-specific credentials has escalated, leading to cloud account takeovers, particularly within Microsoft Azure environments. The rise in identity-centric attacks parallels increases in social engineering campaigns, primarily through phishing. Cybercriminals use link staging and traffic filtering, often via legitimate cloud services, to hide their schemes.

Social media, especially LinkedIn, serves as fertile ground for crafting targeted lures. These

campaigns have also expanded into areas with lower visibility such as communication

platforms. Despite the adoption of multi-factor authentication, such efforts are increasingly difficult to counter due to Adversary-in-the-Middle (AitM) techniques and tools like Evilginx. Cybercriminals are likely to further integrate these methods into their attack playbooks.

While ransomware often captures the headlines, this reporting period has seen a sharp

increase in Business Email Compromise (BEC) incidents. BEC poses and will very likely remain a pervasive threat due to its effectiveness and simplicity in execution. These incidents are particularly challenging to detect because they seldom involve malware or other malicious activities that leave detectable traces of compromise.

The use of crypto drainers and QR , code phishing, or Qishing, has seen a significant

surge. Tools like EvilGophish streamline the creation of QR codes for use in social

ENISA THREAT LANDSCAPE 2024

engineering campaigns, making them a simple addition for security professionals and attackers

alike. Meanwhile, SEO poisoning remains lucrative as well, ensnaring users who search for legitimate documents or software.

Relying on cloud services

A prominent trend in cybercrime is the use of legitimate cloud services not just for orchestrating social engineering attacks but also for malware and data exfiltration. Although this strategy isn't new, its use has been ramped up significantly. This does not suggest a lack of security in these services but rather underscores the adaptability of threat actors. They show a

keen interest in document publishing platforms, leveraging the trusted reputations of

these sites. Additionally, they create subdomains or paths under popular social media and

sharing services, or use well-known websites like Ars Technica, GitHub and Vimeo to host their payloads. Given their effectiveness and relatively low cost, it is highly likely this trend will continue in the foreseeable future.

Financially motivated attackers also demonstrate creativity by using Google Cloud Run for malware distribution, deploying Cloudflare Workers as reverse proxies for phishing or setting up their own workloads in cloud environments. These tactics blend seamlessly with standard IT operations, leaving the victim to bear the cost of the computing resources.

Targeting virtualisation environments

Virtualisation platforms have become pivotal to organisational IT infrastructures, but they can suffer from misconfigurations and vulnerabilities. Moreover, security teams frequently struggle with limited visibility within these platforms, making them prime targets for cybercriminals,

especially ransomware gangs. These groups generally follow a consistent approach, regardless of the ransomware variant used. They gain initial access through social engineering or by exploiting vulnerabilities. Once inside, they delete or encrypt backup systems, exfiltrate data, launch the ransomware and then spread it beyond the virtual environment.

Furthermore, actors have been observed creating snapshots of virtual domain controller disks for offline credential extraction and using virtual serial console access or their own

virtual machines within a victim's environment to evade detection. Additionally, they

exploited network tunnelling features of QEMU, a virtualisation platform, to maintain stealth.

ENISA THREAT LANDSCAPE 2024

This exploitation of virtualisation technology demonstrates that cybercriminals have discovered their potential to maximise the impact of their campaigns and remain undetected, making these platforms likely targets of continued interest.

Adding creativity to extortion techniques

In general, double extortion shows no signs of slowing down. Ransomware groups are

also actively engaging with the media and the public to shape the narrative around their

activities. Some groups even shifted from double extortion to extorting without encryption. Instead of encrypting data, they proceed directly to data theft. Additionally, affiliates are actively

finding new ways to monetise stolen data, sometimes by collaborating with third parties or

external data leak services to re-extort their victims. Cybercrime gangs also noted the implementation of key legislation in 2023 and are adjusting their tactics accordingly. They may likely weaponize disclosure requirements, pushing companies to fulfil extortion demands ahead of the required reporting deadline.

Actions by law enforcement agencies

High-profile arrests and successful take-downs demonstrate a concerted effort to

dismantle criminal networks by law enforcement agencies. Notably , Operation EndGame against the dropper ecosystem and Operation Cronos against LockBit, one of the largest ransomware groups, stood out, not least due to the tongue-in-cheek humour expressed by the participating agencies.

Artificial intelligence for the bad

It is no surprise that cybercriminals have embraced artificial intelligence, and not just as users.

They targeted ChatGPT users in social engineering attacks to steal login credentials, while

also promoting fake AI services through Facebook ads and hijacked pages. Cybercriminals enlisted ChatGPT and similar tools to co-author their fraudulent communications. Researchers uncovered tools such as FraudGPT, designed specifically to craft scam emails, and have

identified incidents where actors used PowerShell scripts likely generated by large language models. Deepfake scams, though less frequent, also made headlines. In one notable

incident , a multinational corporation lost over $25 million when attackers used deepfake

technology to impersonate senior executives. Furthermore, criminals have exploited AI-driven face-swapping services to create deepfakes from stolen mobile phone facial recognition data.

ENISA THREAT LANDSCAPE 2024

Additionally, AI-powered cryptocurrency scams are on the rise, with perpetrators using platforms like YouTube to trap unsuspecting victims.

Initial Access Brokers - IAB

Initial Access Brokers (IABs) maintained their popularity, continuing to profit by providing initial access to cybercrime actors. The abundance of relatively easy-to-exploit vulnerabilities in internet-facing devices and the prevalence of information stealers have further boosted their popularity. Interestingly, some IABs have been utilised by State-nexus actors as well, highlighting the strategic importance of their services.

Rise of information stealers

The rise of information stealers paralleled the popularity of IABs and downloaders. Information stealers are now essential components in attack chains for all threat actors, typically deployed

through phishing, malvertising and misleading posts on social media . RedLine and Raccoon remain among the most common stealers, while new variants such as BunnyLoader and Stealc

have emerged. The landscape also includes the Python-based NodeStealer which targets

Facebook business accounts and Predator AI , designed to target cloud services. Even macOS

is not immune , with stealers able to evade many static signature detection engines. It is almost certain that initial access brokers, downloaders and information stealers will continue to pose a significant challenge for defenders in the coming years.

XaaS

As-a-service offerings remained popular among cybercriminals due to their efficiency and profitability and several of these services received significant updates. Phishing as a Service

(PhaaS) now commonly includes MFA bypass techniques and branding for password

managers. The rise of Drainer-as-a-Service for deploying crypto drainers and Disinformation-

for-Hire for influence campaigns was also notable. New or evolving Ransomware as a

Service (RaaS) offerings , such as RansomHub and Farnetwork, continue to emerge.

Kryptina RaaS, a dedicated Linux attack framework, added a new twist by transitioning from a paid service to an openly available tool.

2.3 PRIVATE SECTOR OFFENSIVE ACTORS TRENDS Surveillance and exploit development ENISA THREAT LANDSCAPE 2024

Commercial surveillance vendors (CSVs) are significantly taking the lead in browser and mobile 201 202 device exploitation. These companies often navigate legal and quasi-legal frameworks, typically concealed by layered corporate ownership structures and their geographical reach allows them to exploit jurisdictional arbitrage. Complicating matters, governments 203 204 205 frequently become customers of these vendors. Recent revelations have shown that the crisis surrounding the hacking of European Parliament phones is widening, raising concerns about confidential EU work. Such cases are not entirely new; journalists and human rights defenders have long been targeted by similar malware. Despite these challenges, some 206 207 international efforts to counter these types of organisations are underway . However, it is very likely that without a coordinated response, these companies will remain central hubs for collecting vulnerabilities and developing exploits.

2.4 HACKTIVISTS’ TRENDS Conflict driven

Hacktivist activity, increasingly driven by ongoing geopolitical conflicts, has become a dynamic element in the cyber threat landscape. It has evolved into a mainstream phenomenon and is now an inevitable dimension of political disputes. The war in Ukraine continues to catalyse a surge in hacktivist activity, with numerous groups aligning themselves with either side of the conflict. Attacks are often retaliatory, aiming to disrupt services and send political messages. The conflict between Israel and Hamas further highlights the role of hacktivists in modern warfare. A notable trend is the international reach of these hacktivist activities, as well as the overlapping interests and tactics of groups involved in these conflicts. Groups associated with Iran and 210 211 Russia began targeting Israeli government and media websites, while groups based in India attacked Palestinian government websites. A significant difference between the two conflicts was noted by Google . In the Israel-Gaza region, there was no spike in cyber operations against Israeli targets before the attack, in stark contrast to Ukraine, which experienced a large increase in Russian cyber threat activity targeting Kyiv in the lead-up to the invasion.

In regards to the European Union according to ENISA, during the reporting period saw nearly 3,662 hacktivist incidents nearly all linked with the ongoing geopolitical crisis between Russia and Ukraine while a small percentage can be observed to be linked with cases from the other geopolitical crisis. The most active group has been NoName057(16) followed Cyber Army of Russia. Continuing on our previous reporting, it is very likely that hacktivism will continue to support a variety of political ideals, particularly in countries experiencing civil unrest or war.

Potential Links with State-nexus actors

A notable trend is the correlation between State-nexus actors and alleged hacktivists. A notable example is CyberAv3ngers, a persona used by Iranian State-nexus actors to target critical

ENISA THREAT LANDSCAPE 2024

infrastructure. The rise of these hacktivist personas serves to cloak state participation in their operations and to influence public opinion, thereby obscuring direct state involvement. Cyber Army of Russia Reborn (CARR) has been linked to the Russian state operating under the APT44 umbrella . It is likely that some State-nexus actors will continue to refine this technique, using it as a convenient method to deny participation and manipulate viewpoints.

FUD - Fear, Uncertainty, and Doubt

Hacktivists continue to amplify the impact of their operations to influence public perception and social discourse. This self-promotion but also the coordinated promotion by affiliated hacktivist groups, whether through social media or other public forums, serves to heighten fear, uncertainty and doubt (FUD) within the target audience.

Internet graffiti: DDoS and defacements

The stream of Internet graffiti, DDoS attacks and defacements remains a threat. Hacktivists 217 218 maintained their operational techniques for conducting DDoS attacks. While not novel, website defacements featured prominently as an easy way to convey a message.

Ransomware, wipers and data theft

Hacktivists further mimic cybercrime operators tactics, such as using ransomware, wipers 221 222 and relying on data theft . Ideology-motivated hacktivist groups are using ransomware payloads to disrupt targets and draw attention to their political causes. Alongside the blending of hacktivism with State-nexus activity, it is likely hacktivists will increasingly adopt cybercrime tactics, sometimes with direct or indirect support from these State-nexus groups.

ENISA THREAT LANDSCAPE 2024 ENISA THREAT LANDSCAPE 2024

3. VULNERABILITIES LANDSCAPE

The analysis of the vulnerabilities landscape provides insights into the evolving landscape of software vulnerabilities and allows the reader to identify trends, patterns and emerging threats thus aiding the enhancement of cybersecurity strategies. By understanding the frequency, severity and types of vulnerabilities discovered, organisations can prioritise patching and mitigation efforts, allocate resources effectively and proactively address potential risks to their systems and data. This proactive approach helps to minimise the potential for security breaches, data breaches and other cyber-attacks, ultimately contributing to a more resilient and secure digital environment .

Moreover, this work is meant to complement the annual ETL by providing a glimpse into the vulnerabilities that are often leveraged in cyber-attacks. The ETL is based on public sources and ENISA has tried to cross-correlate the analysis of the vulnerability landscape with that of the publicly disclosed incidents, to identify trends in the vulnerabilities exploited etc. However, unfortunately it is not common practice to disclose such information to the public and hence this much needed and useful analysis was not feasible. With the Network and Information Security Directive 2 (NISD 2) and Cyber Resilience Act, enhancements in both incident reporting and vulnerability management and disclosure are expected in the EU, which will hopefully enable us to conduct more in-depth and correlated analysis. In our exploration of the CVE Landscape, we considered the following definitions of key terms associated with vulnerability foreclosure:

CVE (Common Vulnerabilities and Exposures) is a standardized system designed for identifying and naming security vulnerabilities in various software and hardware products. It assigns a unique identifier to each vulnerability, making it simpler to track and reference vulnerabilities across different systems and databases.

CVSS (Common Vulnerability Scoring System) is a framework used to evaluate the severity of security vulnerabilities. It offers a numerical score that quantifies a vulnerability's impact and exploitability, helping organisations prioritise which vulnerabilities to address first.

CVSS score has already reached version 4.0

CNA (CVE Numbering Authority) is an organisation or entity responsible for assigning CVE identifiers to vulnerabilities and ensuring their accuracy and consistency.

CWE (Common Weakness Enumeration) is a catalogue of common software and hardware weaknesses, security issues, and coding errors. It serves as a reference for known software security vulnerabilities and is instrumental in improving the understanding and mitigation of these security weaknesses during the software development process.

ENISA THREAT LANDSCAPE 2024 3.1 SUMMARY

During the time-frame under examination in this report, from July 1st, 2023, to July 1st, 2024, a total of 33,524 vulnerabilities were recorded in the NIST NVD. This represents a significant increase compared to the 24,690 vulnerabilities reported in the previous ETL document for the period between July 1, 2022, and July 1, 2023.

Additionally, it's noteworthy that within this specific time-frame, 123 out of the 33,524 published vulnerabilities are part of the 'CISA Known Exploited Vulnerabilities catalogue' (also referred to as KEV list). It is important to highlight that for a vulnerability to be included in the 'CISA Known Exploited Vulnerabilities Catalogue,' it must satisfy specific criteria such as having an ID, there should be evidence of active exploitation and a clear remediation action, such as a vendor-provided update, should be available.

3.2 ANALYSIS OF THE CVE NUMBERING AUTHORITIES (CNA )

In the section below, an analysis of the allocation of CVEs by CVE numbering authorities (CNAs) has been carried out. The aim of this analysis is to identify any discernible trends or patterns related to specific vendors, which can assist the reader in making informed decisions about prioritising patching activities. Within the EU and EFTA countries, there are 50 partner CNAs including ENISA. The following illustration presents the distribution of CVE numbers assigned by each CVE numbering organisation (CNA) for the specified period from July 2023 to July 2024:

Figure 12: CVEs by CVE Numbering Authority (CNA) (Percentage of the total)

Figure 13: CVEs with CVSS greater than 9 assigned by the CNAs (Percentage of the total)

ENISA THREAT LANDSCAPE 2024

By comparing both figures (Figures 12 and 13), it becomes evident that the allocation of critical vulnerabilities with a CVSS score above 9, differs between the various CNAs. For example, MITRE, one of the two Top-Level Root CNAs, is responsible for one-third of the critical vulnerabilities in the overall count which is correlated also with the overall allocation of vulnerabilities.

3.3 ANALYSIS OF THE CVE LANDSCAPE

In this year's ETL report, a total of 19,754 vulnerabilities were identified that had encoded their afferent severity score information. Out of the aforementioned vulnerabilities, 9.3% fell into the ‘critical’ category and 21.8% were categorised as ‘high’ according to their CVE base Severity tag.

Among these vulnerabilities, it is noteworthy that approximately 123 of them were subsequently included in the CISA Known Exploited Vulnerabilities (KEV) list. This selection indicates that these particular vulnerabilities were actively targeted and exploited by malicious actors, making them of significant concern to the security community .

ENISA THREAT LANDSCAPE 2024

Figure 14: Percentage of CVEs by Severity (Percentage of the total)

The donut chart, as depicted in Figure 14, offers a comprehensive view of the distribution of

vulnerabilities by their severity tags LOW, MEDIUM, HIGH, or CRITICAL. The diagram includes vulnerabilities for which there is no specific severity information, tagged as ‘Blank’. This additional category acknowledges that there are vulnerabilities for which the assessment of their severity is either pending, not yet determined or, for some other reason, has not yet been assigned. In essence, this section of the chart highlights the existing uncertainties or gaps in categorising these vulnerabilities based on their severity.

Figure 15: Number and percentage of CVEs by attack vector

ENISA THREAT LANDSCAPE 2024

It is crucial to underscore the importance of patching internet-facing applications that contain vulnerabilities rated as ‘high’ or ’critical’. This practice is essential to safeguard an organisation from potential attacks. In numerous instances, vulnerabilities falling into these categories may present a more accessible entry point for malicious actors seeking to breach systems and access data. Such breaches could result in financial losses, harm to an organisation's reputation or even lead to regulatory penalties. However, it is imperative not to disregard vulnerabilities with lower severity ratings, as they often serve as footholds in the later stages of cyber-attacks. It is worth noting that approximately 20% of vulnerabilities from the CISA KEV list fall into the ’medium‘ severity category.

In Figure 15, 76.29% of the vulnerabilities for which the attack vector information is available are exploitable via a Network.

Figure 16: CWEs 2023-2024

Table 1: MITRE TOP 25 CWEs 2023

Rank CVEs in Rank ID Name Score Change KEV vs. 2022 1 CWE-787 Out-of-bounds Write 63.72 70 0 Improper Neutralisation of Input During Web 2 CWE-79 45.54 4 0 Page Generation ('Cross-site Scripting') Improper Neutralisation of Special Elements 3 CWE-89 34.27 6 0 used in an SQL Command ('SQL Injection') 4 CWE-416 Use After Free 16.71 44 3 ENISA THREAT LANDSCAPE 2024 Improper Neutralisation of Special Elements 5 CWE-78 used in an OS Command ('OS Command 15.65 23 1 Injection') 6 CWE-20 Improper Input Validation 15.50 35 -2 7 CWE-125 Out-of-bounds Read 14.60 2 -2 Improper Limitation of a Pathname to a 8 CWE-22 14.11 16 0 Restricted Directory ('Path Traversal') 9 CWE-352 Cross-Site Request Forgery (CSRF) 11.73 0 0 Unrestricted Upload of File with Dangerous 10 CWE-434 10.41 5 0 Type 11 CWE-862 Missing Authorisation 6.90 0 5 12 CWE-476 NULL Pointer Dereference 6.59 0 -1 13 CWE-287 Improper Authentication 6.39 10 1 14 CWE-190 Integer Overflow or Wraparound 5.89 4 -1 15 CWE-502 Deserialisation of Untrusted Data 5.56 14 -3 Improper Neutralisation of Special Elements 16 CWE-77 4.95 4 1 used in a Command ('Command Injection') Improper Restriction of Operations within the 17 CWE-119 4.75 7 2 Bounds of a Memory Buffer 18 CWE-798 Use of Hard-coded Credentials 4.57 2 -3 19 CWE-918 Server-Side Request Forgery (SSRF) 4.56 16 2 20 CWE-306 Missing Authentication for Critical Function 3.78 8 -2 Concurrent Execution using Shared Resource 21 CWE-362 with Improper Synchronisation ('Race 3.53 8 1 Condition') 22 CWE-269 Improper Privilege Management 3.31 5 7 Improper Control of Generation of Code ('Code 23 CWE-94 3.30 6 2 Injection') 24 CWE-863 Incorrect Authorisation 3.16 0 4 25 CWE-276 Incorrect Default Permissions 3.16 0 -5

The findings presented in Figure 16 correlate to a large extent with the list of the top 25 vulnerabilities in 2023 published by MITRE, as well as with the previous year's ETL report. The recurring appearance of fundamentally similar software development flaws in the data, with a few exceptions, sheds light on the enduring challenges in secure software development. It underscores the limited progress made in addressing these vulnerabilities over time. While there are certainly outliers in the comparison and no absolute congruence, a broader view reveals striking resemblances between the types of vulnerabilities.

The figure below (figure 17) shows the top weaknesses (CWEs) that are responsible for a large chunk of critically severe vulnerabilities. In this instance, the data was appropriately filtered to focus on the ‘critical’ severity parameter.

ENISA THREAT LANDSCAPE 2024

Figure 17: Top CWEs by responsibility for critical severity (percentage of total)

According to the FIRST CVSS SIG, vulnerabilities that carry the CRITICAL base severity tag are those with a Common Vulnerability Scoring System version 3 (CVSSv3) score falling within the range of 9.0 to 10.0. These are the most severe vulnerabilities, indicating that they possess a high potential for exploitation and pose significant risks to systems and data.

Many of these weaknesses are specifically related to web vulnerabilities, which are often prime targets for attackers seeking unauthorised access. Web-related vulnerabilities encompass flaws affecting web applications, websites, and the underlying internet infrastructure.

In order to mitigate the risks posed by these critical vulnerabilities, organisations should strongly consider investing in secure software development practices and adopting relevant strategies. ‘Secure-by-design and default’ principles play a pivotal role in this context. These principles emphasise building software with security in mind from the very beginning and configuring systems in a secure manner by default. By incorporating secure development practices, organisations can proactively reduce the likelihood of critical vulnerabilities surfacing in their software or systems.

Recent efforts have been made by a consortium of international organisations to propose and advocate for good practices in secure software development .

3.4 ANALYSIS OF KNOWN EXPLOITED VULNERABILITIES (KEV).

The CISA KEV catalogue is a dynamic catalogue of known exploited vulnerabilities that is updated with new vulnerabilities on a regular basis (the attackers never stop hence the list is constantly increasing). It is recommended that the catalogue of KEVs be used as a basis for

ENISA THREAT LANDSCAPE 2024

any organisation’s vulnerability management plans because those vulnerabilities have been observed in the wild by CISA to have been exploited or are under active exploitation.

In the timeframe of this year’s ETL (July 23 to July 24), 123 vulnerabilities were published in the KEV list; currently the entire CISA KEV list contains a total of 1,131 vulnerabilities.

The table below highlights the CWEs which account for part of the 123 vulnerabilities from the KEV list.

Table 2: CWEs responsible for KEVs 2023-2024

Another notable deliverable for the past year is the informative report titled 2022 Top Routinely Exploited Vulnerabilities , jointly published by CISA in collaboration with the Five Eyes partners, i.e. the United Kingdom, Australia, Canada, New Zealand, and the United States.

ENISA THREAT LANDSCAPE 2024

Figure 18: 2022 Top routinely exploited vulnerabilities by Vendors (2023 version hasn’t been published)

In the ETL report from the previous year, we introduced the Exploit Prediction Scoring System (EPSS) which underwent a significant update at the beginning of 2024 reaching to version 3.0. The EPSS score is designed to enhance the ability of organisations to prioritise system patching effectively. It quantifies the likelihood of a vulnerability being exploited within the next 30 days. It is important to note that the EPSS score is a momentary snapshot and can evolve over time as vulnerabilities progress.

3.5 BACKGROUND

In conducting the analysis of the CVE (Common Vulnerabilities and Exposures) landscape, several crucial data sources were used to ensure a comprehensive and well-informed analysis. These data sources played a pivotal role in shedding light on the state of vulnerabilities and security threats. Here are the primary sources used:

1. NIST NVD (National Vulnerability Database): The NVD, maintained by the National Institute of Standards and Technology (NIST), stands as one of the foremost repositories for information regarding known vulnerabilities. It provides a comprehensive listing of vulnerabilities across a wide spectrum of software and hardware products. The database is continually updated to reflect the latest discoveries and assessments of vulnerabilities. You can explore the full listing here: NVD Full Listing.

2. CISA Known Exploited Vulnerability Catalogue (KEV): The CISA (Cybersecurity and Infrastructure Security Agency) Known Exploited Vulnerability Catalogue is a valuable resource that catalogues vulnerabilities that are actively exploited by malicious actors. The catalogue provides insights into vulnerabilities that are currently targeted and exploited in the cybersecurity landscape. A snapshot of this catalogue, as of August 12, 2022, was used to identify vulnerabilities that are actively leveraged in attacks. Further details on the KEV catalogue can be accessed here: CISA KEV Catalogue.

ENISA THREAT LANDSCAPE 2024

3. FIRST Exploit Prediction Scoring System (EPSS): The FIRST (Forum of Incident Response and Security Teams) Exploit Prediction Scoring System, also known as EPSS, is an important tool for predicting the likelihood of a vulnerability being exploited. It offers a scoring system that assesses the potential risk associated with vulnerabilities. EPSS provides valuable data and statistics related to vulnerability predictions and exploits. To delve deeper into the details of EPSS, you can refer to these resources: EPSS Details and EPSS Data and Stats.

By drawing insights from these sources, the analysis of the CVE landscape benefited from a well-rounded perspective on vulnerabilities, their severity, and their potential exploitation. This multifaceted approach allows for a more comprehensive understanding of the evolving cybersecurity threats and vulnerabilities that have an impact on the digital landscape.

ENISA THREAT LANDSCAPE 2024 ENISA THREAT LANDSCAPE 2024

4. RANSOMWARE

In ENISA’s report on the Threat Landscape for Ransomware Attacks , ransomware was defined as: a type of attack where threat actors take control of a target’s assets and demand a ransom in exchange for the return of the assets' availability. This definition covers the three key elements present in every ransomware attack:

• assets • actions • blackmail.

This generic yet descriptive definition was needed to cover the changing ransomware threat landscape, the prevalence of multiple extortion techniques and the various goals other than solely financial gains. This report also covers the four high-level actions (lock, encrypt, delete and steal) used by ransomware to impact the confidentiality, availability and integrity of the assets. It can serve as a reference to better understand this threat.

By contrast, the definition of ransomware in NIST describes ransomware as: a type of malicious attack where attackers encrypt an organisation’s data and demand payment to restore access. In some instances, attackers may also steal an organisation’s information and demand additional payment in return for not disclosing the information to authorities, competitors or the public .

Following up on the established trend we have witnessed over the last few years, throughout the reporting period a substantial increase in ransomware-related incidents was observed, thus reaffirming the ongoing growth of the ransomware threat. Notably, the number of ransomware incidents has stabilised around the 1000 claims per quarter over the second quarter (Q2) of 2024 as seen in figure 18 . It is worth mentioning that the incidents under analysis were as reported on DLSs (data leak sites).

ENISA THREAT LANDSCAPE 2024

Figure 19 ETL 2023 vs ETL 2024

Figure 20: Time series of major incidents observed by ENISA (July 2023-June 2024)

ENISA THREAT LANDSCAPE 2024

Figure 21 Breakdown of Sectors by threat type and region

In Figure 21, the timeline illustrates the activity of the most active ransomware groups as reported in their leak sites and the victims posted there. Notably, threat actor Lockbit maintained consistent activity throughout the entire period even though this RaaS provider was dismantled in an operation during February 2024. Despite the take-down operation, what followed was increased activity during the end of the reporting period which will be discussed in greater detail below. The rest of the ransomware groups follow a more stable timeline with Akira increasing activity during the end of the reporting period

Figure 22: Timeline of the 20 most active Ransomware groups during the reporting period

4.1 MOST ACTIVE RANSOMWARE STRAINS

LockBit, Cl0p and PLAY were some of the top ransomware strains used in RaaS (Ransomware as a Service) and extortion attacks in terms of victim organisations, dominating the global landscape during the reporting period (Figure 21). LockBit accounted for nearly half the number of incidents that were reported. In addition, Cl0p, while being one of the most active groups in 2023 (notably exploiting two different zero-days in their campaigns), has nonetheless remained inactive during the first semester of 2024. It is also noteworthy that PLAY remains a constant variant throughout the reporting period 47

ENISA THREAT LANDSCAPE 2024

Figure 23: Five Most active Ransomware groups on the Global Landscape

`

Ransomware attacks target a broad spectrum of industries, with the Industrial and Manufacturing sector being the most frequent, high-impact victim, followed closely by Retail and Digital Service Providers.

The industrial sector's heavy reliance on automation, supply chain operations, and critical infrastructure makes it a prime target for cybercriminals. Successful attacks can result in significant financial losses, operational disruptions, and reputational damage. Retailers are attractive targets due to the vast amounts of sensitive customer data they handle, including credit card information. This data can be stolen and sold on the dark web for substantial profits. Additionally, ransomware attacks can disrupt operations, leading to lost sales and ransom demands.

Digital Service Providers are also at risk due to their reliance on digital infrastructure and the value of their customer data. Successful attacks can result in service disruptions, loss of customers and reputational harm. Furthermore, supply chain attacks targeting this sector are increasingly common. The United States is the global epicentre for ransomware attacks, accounting for nearly half of all incidents worldwide during this period. Its diverse industrial landscape, critical infrastructure and presence of numerous large corporations create a lucrative environment for cybercriminals.

Figures 22, 23 and 24 present a breakdown of three ransomware strains. It is evident that, on a global scale and in terms of targeted sectors, LockBit and PLAY primarily focus on similar sectors in the majority of incidents. On the other hand, Cl0p deviated and exhibited a significant concentration of attacks on Digital Service Providers as well as the Financial Sector. When considering the regional aspect, the majority of victims in all cases are in the USA, followed by various EU countries.

ENISA THREAT LANDSCAPE 2024

Figure 24: Lockbit break down by sectors and countries

Figure 25: CL0P break down on sectors and countries

ENISA THREAT LANDSCAPE 2024

Figure 26: PLAY break down on sectors and countries

In the context of the European landscape, it is notable that LockBit ransomware has again emerged as a prominent Ransomware-as-a-Service group, being responsible for more than half of the recorded ransomware incidents during the reporting period (Figure 25). Furthermore, two other ransomware groups, 8Base and Cl0p, have also played significant roles in this cybersecurity landscape, contributing to the complexity and diversity of ransomware attacks across the EU.

Figure 27: Five Most active Ransomware groups on the EU Landscape

In Figures 27, 28 and 29, we can observe a detailed visualization of the aforementioned three distinct ransomware groups, focusing on their operations in the EU.

ENISA THREAT LANDSCAPE 2024

Figure 28: Lockbit breakdown on countries and EU sectors

Notably, the most targeted sector varies across all three groups, indicating a diverse range of targets within each group's operations. However, this contrasts with the global perspective, where Lockbit and 8base have displayed a heightened focus on the manufacturing sector and the retail sector, while the CL0p group has directed its attention towards ICT service management.

Figure 29: 8Base breakdown on sectors and EU countries

ENISA THREAT LANDSCAPE 2024

Figure 29: CL0P group breakdown on sectors and EU countries

The information presented here has been derived by merging data collected from the leak sites associated with various extortion groups and supplementing it with Open-Source Intelligence (OSINT). Different statistics from different vendors also confirm LockBit as the most active ransomware gang in 2023 with Cl0p however accounting for more than half of all ransomware incidents during the second half of 2023 .

4.2 LOCKBIT CIRCLE OF LIFE: RISE, FALL, POTENTIAL RESURGENCE WITH RECYCLED VICTIMS

LockBit rapidly ascended to prominence as the dominant ransomware group through its RaaS model, leveraging a vast affiliate network to launch frequent attacks. Targeting smaller businesses for quicker returns amplified its financial success. As reported in ENISA's previous ETL, LockBit consistently ranked as the most active ransomware family .

However, a coordinated law enforcement operation, named Operation Cronos , struck a significant blow. On February 20, 2024, authorities seized LockBit's infrastructure, recovered decryption keys for thousands of victims, and took control of its data leak site. The indictment of key operator Dmitry Yuryevich Khoroshev on May 7, 2024 , further impacted the group.

Despite these setbacks, LockBit has demonstrated remarkable resilience. While the group has managed to reconstitute its operations, the extent of its resurgence has been exaggerated. A Trend Micro report revealed that a substantial portion of victims claimed on LockBit's new data leak site were either reuploads of previous attacks or misattributed to the group. .

While LockBit remains a formidable threat, its capacity to maintain its previous level of dominance is increasingly challenged by law enforcement actions and the revelation of inflated victim claims.

ENISA THREAT LANDSCAPE 2024 4.3 RANSOM DEMAND VS. RANSOM PAYMENT

Ransomware attacks remained a persistent threat throughout the reporting period, with a consistent rate of incidents. While the frequency of attacks held steady, a notable shift emerged in victim behaviour. An increasing number of organisations declare to pay ransom demands, signalling a growing resilience against these cyber-attacks. When payments are made, they often fall short of the initial amounts demanded, indicating that successful negotiation tactics 246 247 248 were employed by victims .

Several factors contribute to this evolving landscape. Enhanced cybersecurity measures, including robust backup and recovery strategies, have empowered organisations to withstand ransomware attacks without financial capitulation. Additionally, intensified law enforcement efforts against ransomware groups have created a more hostile environment for cybercriminals, reducing the perceived risk of refusing payment. As victims become more aware of the potential consequences of paying ransoms, such as reinfection and funding illicit activities, they are increasingly opting to explore alternative recovery paths.

However, the overall trend of decreased ransom payments was punctuated by a stark outlier. A record-breaking ransom payment of US$75 million was extorted from a single company , a staggering sum that nearly doubled the previous highest-known pay-out. This extraordinary incident underscores the immense financial risk posed by ransomware attacks and the potential for catastrophic consequences if organisations are unprepared .

While the overall picture suggests a growing reluctance to pay ransoms, the reality remains complex. The decision to pay or not is influenced by various factors, including the nature of the business, the criticality of the encrypted data, and the organisation's risk tolerance.

4.4 LEAKS SITES – RECYCLING – DOUBLE-DIPPING

Even though it first appeared in 2020 during the reporting period, a trend known as ‘doubledipping’ has increased, where victims are targeted multiple times. This malicious practice involves re-victimizing organisations through various methods. Cybercriminals may exploit previously identified vulnerabilities or use stolen credentials to launch subsequent attacks on the same victim. Exfiltrated data can be repurposed for additional extortion attempts, such as selling it on the dark web or using it to blackmail the victim. Ransomware groups often exaggerate the amount of data stolen or falsely claim to have compromised specific systems to 251 252 increase pressure on victims .

The practice of ransomware double-dipping has become increasingly prevalent. Cybercriminals employ advanced tactics to re-victimize organisations, often exploiting vulnerabilities or stolen credentials from previous attacks. Several ransomware groups have been observed re-selling stolen data on dark web marketplaces after an initial attack or even recycling the same victims on their leak sites. Ransomware operators frequently exaggerate stolen data or falsely claim compromised systems to increase pressure on victims. The number of victims on a data leak site is inherently incomplete, as those paying ransoms quickly aren't listed. Additionally, some groups post more non-paying victims, skewing the perception of risk .

4.5 INCREASED OPERATIONS BY LAW ENFORCEMENT ENISA THREAT LANDSCAPE 2024

Law enforcement agencies significantly escalated their offensive against ransomware groups during this reporting period . Notable operations include the takedown of Trigona by the pro- Ukraine group UCA in October 2023 even though this was not done by law enforcement and the dismantling of Ragnar Locker by multiple European law enforcement agencies in the same month . In December 2023, the FBI temporarily disrupted BlackCat/ALPHV, a prominent RaaS, though the group later resurfaced under suspicion of an internal scam .

LockBit in February 2024 during Operation Cronos , when law enforcement compromised its infrastructure. Despite this, LockBit persists, employing questionable tactics such as data recycling and fabricated victim claims. The subsequent exposure of LockBitSupp's identity by law enforcement led to an increased volume of victim announcements on LockBit's data leak site and a reduced online presence for LockBitSupp.

4.6 SHIFTING FROM ENCRYPTION TO DATA EXTORTION CONTINUES – MOTIVATION VARIES FROM OPPORTUNISTIC TO BIG GAME

The trend of ransomware and extortion attacks continued to evolve and expand, posing a significant threat in this reporting period. This builds upon observations from the previous report, highlighting the continuous growth of this cybercrime. One interesting aspect on the cyber extortion was that the tactics employed go beyond traditional ransom demands. The ALPHV/BlackCat ransomware group has taken extortion to a new level by filing a fake SEC complaint against a victim who didn't pay. This showcases the evolving tactics cybercriminals 259 260 use to pressure victims .

We noticed that ‘big game hunting’ is still relevant; actors such as the Dark Angels ransomware group, which operates the Dunghill data leak site, emerged around May 2022. The group has conducted some of the largest ransomware attacks yet has managed to attract minimal attention . Nevertheless, most threat groups go for an opportunistic approach as shown in the previous graphs by the variety of sectors and geographical spread. Their victims include smaller businesses, with less than 1,000 employees and are 4.2 times more likely to be impacted. This might be due to the sheer number of small businesses, making them easier targets in a broad ‘harvest’ by attackers aiming to hit anyone who is vulnerable .

.

ENISA THREAT LANDSCAPE 2024 ENISA THREAT LANDSCAPE 2024

5. MALWARE

Malware, also referred to as malicious code and malicious logic, is an overarching term used to describe any software or firmware intended to perform an unauthorised process that will have an adverse impact on the confidentiality, integrity or availability of a system . Examples of malicious code include viruses, worms, trojan horses or other code-based entities that infect a host . Malicious actors develop malware or acquire it through Malware-as-a-Service (MaaS) to carry out malicious cyber campaigns and support their operations, gaining and retaining control over assets, evading defences and conducting post-compromise actions . Consistent with previous ETL reports, we classify malware as a distinct prime threat compared to ransomware, given the significant prevalence of ransomware strains across the landscape and their particular motivation that necessitates dedicated and focussed attention. At the same time, the threat of malware remains at a high level, with threat actors continuously evolving their approaches and inventing new means, TTPs and malware families to make it more difficult for defenders and cybersecurity professionals to implement proportionate mitigation controls.

Depending on the goal of the threat actor, malware functionality can range from getting control over systems and networks (e.g. botnets), over data (e.g. information stealing),to allowing remote access to infected networks (e.g. Remote Access Trojans (RATs)) and installing other malicious software onto the victims’ devices (e.g. downloaders). ). Based on ENISA’s dataset, Information stealers were found to be again one of the most frequent sightings during the reporting period. We have noted a significant uptick in incidents related to malware, as illustrated in Figure 31. We can also discern a more detailed breakdown of these threats based on sectors and regions, shown in Figure 32.

Figure 30: Time series of major incidents observed by ENISA (July 2023-June 2024)

ENISA THREAT LANDSCAPE 2024

It is noteworthy that malware has experienced a resurgence, particularly through infostealers. This increase is linked to numerous discoveries of campaigns from different state-linked actors and the growth of XaaS (Anything as a Service).

Figure 31: Breakdown of Sectors by threat type and region

5.1 MALWARE INFORMATION STEALERS PERSIST AND EVOLVE

Reports indicate a rise in overall malware detections. Information stealers, a type of malware that pilfers sensitive data, continue to be a significant concern. According to information from 266 267 multiple sources and from data collected by ENISA itself as seen in figure 31, the most common information stealers throughout 2023 and 2024 were:

• RedLine: A malware that steals saved credentials, autofill data and banking information appeared in 2020, and saw a wide distribution in different cyber-attacks. Most of the time, however, it was aimed against single users, as its functionality fits best for this purpose. Key targets for the RedLine are data in cryptocurrency wallets, both from desktop versions and browser plugins. Still, it can gather other data, such as FTP/VPN configurations and session tokens for apps such as Discord or Steam. • Raccoon Stealer: a password stealer and crypto stealer that targets autofill logs, cryptocurrency wallets. In its scope are browser autofill files, cookies and online banking credentials, on top of the ability to pluck cryptocurrency wallets . • Vidar: A trojan malware that can steal sensitive information via a computer. It offers a modular approach towards data stealing. It also performs self-destruction after successful data exfiltration. Additionally, it is often spread in a bundle with other malware, such as STOP/Djvu ransomware. Methods of selling it to cybercriminals, however, are less unique – it uses Telegram channels dedicated to malware promotion . • Agent Tesla: a Remote Access Trojan (RAT) written in .NET that has been around since 2014 . Initial access brokers (IAB) often use it to exploit corporate networks. This access is then resold to affiliated threat actors, as part of a Malware-as-a-Service (MaaS) business model • FormBook malware (also known as xLoader): similar characteristics to the above to the strains but is known for its form-grabbing techniques to extract data directly from website HTML forms.

ENISA THREAT LANDSCAPE 2024

• Lumma Stealer : offered as a malware-as-a-service and it target cryptocurrency wallets, login credentials, and other sensitive information on a compromised system

Figure 32: Most active 10 malware strains

While these top five remain dominant, Information stealers are growing more complex even while the top threats remain familiar.

5.2 NEW TECHNIQUES AS MALWARE DELIVERY MECHANISMS

During the reporting period we noticed Malware being delivered through various methods. Fileless malware, evading traditional antivirus, exploits system tools to execute payloads. Social engineering tricks users into downloading malware through phishing. Malvertising embeds malware in online ads, expanding the attack surface. Additionally, attackers are still using methods like OneNote files, password-protected archives, and deceptive HTML phishing pages more than ever especially after the disabling of Macros in Microsoft files. In addition, watering- 274 275 hole attacks compromise websites to infect visitors, and supply chain attacks target partners to infiltrate larger networks .

However, a concerning trend that was seen continuously exploitation of zero-day by threat actors. These previously unknown vulnerabilities, for example the quite recent CVE-2024-3400 vulnerability which was incorporated by the cryptominer malware RedTail and is capable of exploiting a variety of devices and applications, demonstrate the versatility of zero-day 277. attacks

Another example involves a phishing email containing a malicious SVG file. Clicking the attachment triggers a download of a ZIP file containing an obfuscated Batch file. This elaborate

ENISA THREAT LANDSCAPE 2024

scheme ultimately delivers the Venom RAT malware, enabling attackers to install plugins and 278. maintain control over victim environments

Lastly during this reporting period an increase has been observed in the use of trojanized libraries in software development. This trend is likely due to the growing popularity and reliance on open-source libraries in software development. As more developers use these libraries, the potential for malicious actors to target them increases.

5.3 MOBILE MALWARE

During this reporting period a surge in mobile banking trojans was observed, with a concomitant increase in the complexity of their attack vectors. Research indicates a 200% year-over-year growth in malware families targeting banking applications, expanding from 10 to 29 distinct families and from 600 to 1,800 affected applications globally .

These malicious payloads incorporate a diverse range of functionalities, including Automated Transfer Systems (ATS) to facilitate unauthorised transfers of funds, Telephone-based Attack Delivery (TOAD) for social engineering, screen sharing capabilities for remote device control, and the leveraging of Malware-as-a-Service (MaaS) models for rapid threat distribution .

Emerging threats such as GoldPickaxe , capable of synthesising deepfake videos using stolen facial recognition data, and Brokewell , a Trojan with extensive device takeover capabilities, underscore the evolving nature of the threat landscape in mobile banking. Additionally, the Grandoreiro banking trojan, employing advanced obfuscation techniques and targeting a broad spectrum of financial institutions, exemplifies the increasing sophistication of these attacks.

5.4 MALWARE-AS-A-SERVICE

Malware-as-a-Service (MaaS) offerings have become a significant and rapidly evolving threat, particularly since mid-2023. These services provide easy access to a wide range of advanced malware, including information stealers, botnets, and remote access trojans (RATs), at competitive prices. Notably, some MaaS vendors even offer ‘malware-for-hire’ models, handling the attack execution for clients .

MaaS thrives on continuous innovation, constantly updating malware to bypass security measures and evade detection (observed since June 2023). Some platforms mimic legitimate software by providing customer support and software updates. Indicators of compromise (IOCs) will vary depending on the specific malware deployed, but suspicious network traffic originating in June 2023 or later, unauthorised remote access attempts and unknown software processes are common signs. MaaS actors often exploit unpatched vulnerabilities in systems and software.

The impact of MaaS is multifaceted. Information stealers, a prominent MaaS offering, target sensitive data such as login credentials and financial information, potentially leading to significant financial losses. Compromised systems can expose sensitive data, impacting individuals and organisations alike. Additionally, deployed malware can disrupt critical systems and operations. Observations since June 2023 highlight the use of MaaS platforms to distribute

ENISA THREAT LANDSCAPE 2024

threats such as Bandit Stealer (information stealer), Lumma Stealer (targets crypto wallets and 286 287 288 289 2FA), DarkGate and other remote access trojans (RATs) .

5.5 IMPACT OF LAW ENFORCEMENT ACTIONS

On May 27th and 29th, 2024, a coordinated international law enforcement effort known as Operation Endgame disrupted the activities of multiple dropper malware families. These families, including Bumblebee, IcedID, Pikabot, Smokeloader, SystemBC, and Trickbot, played a crucial role in facilitating ransomware attacks.

Deployed during the first stage of malicious attacks, these droppers have been used to harvest information, maintain control of compromised machines and deploy additional malware families, including ransomware. After deploying malware, the droppers remain inactive or remove themselves. Bumblebee was mainly used for payload delivery, IcedID evolved from a banking trojan to support other cybercrimes, Pikabot was used for data theft, remote access and the deployment of ransomware, while SystemBC provided anonymous communication with 290 291 command-and-control (C&C) servers .

Late last year, the FBI dismantled a vast network of compromised home and small office routers used by Chinese state-sponsored hackers. Dubbed ‘Volt Typhoon’, these hackers exploited hundreds of US-based routers with the ‘KV Botnet’ malware to mask their origins while targeting critical infrastructure within the US and other countries .

Finally, in August of 2023 , Qakbot, one of the largest and longest-running botnets to date, was taken down following a multinational law enforcement operation spearheaded by the FBI and known as Operation 'Duck Hunt'. The botnet (also known as Qbot and Pinkslipbot) was linked by law enforcement to at least 40 ransomware attacks against companies, healthcare providers and government agencies worldwide, causing hundreds of millions of dollars in damages according to conservative estimates. However, a small revival was noticed through phishing campaigns just three months later . Eradicating malware is not a one-time win. Qbot's resurgence highlights the ongoing challenge of staying ahead of adaptable cybercriminals who exploit new technologies.

ENISA THREAT LANDSCAPE 2024 ENISA THREAT LANDSCAPE 2024

6. SOCIAL ENGINEERING

Social engineering refers to all techniques aimed at talking a target into revealing specific 295 . information or performing a specific action for illegitimate reasons . While we will discuss this in the context of cybersecurity, notice that social engineering is also used in the physical, nontechnological realm. In social engineering, the attacker will in fact exploit the human factor, often also considered as the weakest link in any security chain, for its malicious purpose . To do so, the attacker will often pose (impersonation or persuasion) as a trusted person or source to gain its victim's trust. Different techniques are used today to achieve these goals :

Phishing aims to trick recipients into clicking and revealing sensitive information such as passwords, credit card numbers or personal data. Attackers use deceptive emails, messages or links to websites that appear legitimate. Spear-phishing is like phishing but highly targeted. To appear even more convincing, attackers customise messages based on specific information about the organisation or specific target. Often, open-source information gathering (OSINT) is used by threat actors to investigate their target.

Smishing is an attack that uses mobile text messages (SMS), impersonating a reputable company or trustworthy actor. The term is a combination of SMS (short message service) and phishing. .

Vishing is a form of phishing that occurs over voice communications, usually phone calls. Attackers impersonate trusted entities and persuade victims to reveal sensitive information. With the rise of AI, it has become much easier to generate audio from a baseline recording.Next to these phishing techniques, we also discuss approaches used by attackers to convince targets, including but not limited to :

Pretexting is the approach when a malicious actor creates a fabricated scenario or pretext to obtain information. Pretexting often involves impersonation, where the actor pretends to be someone else, either online or in person, to gain trust and manipulate the target into disclosing confidential information or taking specific actions.

Business Email Compromise (BEC) leverages pretexting by using existing email chains to convince a victim to perform an action. In addition CEO fraud, a sub-set subset of business email compromise (BEC), leverages pretexting by impersonating a company’s CEO or highranking executive to con other employees, partners, or vendors into a scam.

During this reporting period, a noteworthy increase in social engineering incidents was observed towards the end of H2 2023, as illustrated in Figure 32. Moreover, a more granular view of these threats taking into account sectors and regions is available. One crucial takeaway is that social engineering campaigns, in various forms, persist as a substantial threat to users as evidenced in Figure 33.

ENISA THREAT LANDSCAPE 2024

Figure 33: Time series of major incidents observed by ENISA (July 2023-June 2024)

Figure 34: Break down of Sectors by threat type and region

6.1 PHISHING INCIDENTS REMAIN A MOST IMPORTANT INITIAL VECTOR

Phishing and pretexting via email continue to be the leading cause of cybersecurity incidents. According to Verizon, phishing and pretexting accounts for 73% of breaches of social engineering incidents. Business email compromise, which falls under pretexting in the Verizon statistics, continues to have an important financial impact. While the median transaction remained stable, it still accounts for 50K USD in losses. An important addition in this report is that, of all the victims who reached out to law enforcement, they were able to get back 79% of their losses in half of the cases. . The FBI reports that, in 2023, they received more than 22,000 complaints relating to Business Email compromise with adjusted losses of over 2.9

ENISA THREAT LANDSCAPE 2024

billion USD . IBM reports, throughout 2023, an average cost of 4.67M USD for a data breach with Business email compromise as the initial attack vector. Social Engineering as an initial vector is reported as having an average cost of 4.55M USD in general. Phishing in general was reported as most prevalent attack vector (16%) and the second most expensive at USD 4.76M USD, while 17% originated through business email compromise .

Another IBM report also concludes that a total of 30% of the incidents they managed in 2023 were related to phishing . Also for 2023, Mandiant saw exploits used as the most prevalent initial infection vector (38% of intrusions) followed by phishing in second place. However, phishing declined globally in 2023, with 17% of intrusions, compared to 22% in 2022. When looking at EMEA specifically, we can see phishing attacks falling back to 16% of intrusions for 2023 .

Avast states that on the mobile device landscape, more than 90% of all threats blocked in the last quarter of 2023 originated from scams and similar threat types (which includes phishing at 30%, scams at 45%, and others) . In the Q1 2024 Phishing Activity Trends Report, the APWG (Anti-Phishing Working Group) observed almost five million phishing attacks throughout 2023, marking it as a record year. In the first quarter of 2024, APWG observed just under 1 million phishing attacks, the lowest quarterly total since Q4 2021. This number is significantly lower than the 1.6 million attacks seen in Q1 2023, which was the highest quarter recorded in APWG's historical observations. Overall, the number of attacks per month remained stable from June 2023 to March 2024 . These observations are not all aligned, but they do show that a decline in phishing was ongoing from 2023 to 2024.

Apart from initial access vectors, phishing also dominates the ranks of cybercriminals. Phishing is the top digital crime type identified by the FBI by far, followed by personal data breach, non-payment / non-delivery, extortion and the tech support categories.

6.2 TOP PHISHING BRANDS

Check Point Research identified the following top spoofed brands based on their overall appearance in brand phishing events during Q4 2023: Microsoft (33%), Amazon (9%), Google (8%), Apple (4%), Wells Fargo (3%) . For Q1 2024 we mainly saw an increase for Microsoft and LinkedIn: Microsoft (38%), Google (11%), LinkedIn (11%), Apple (5%), DHL (5%) .

IBM reports similar data, although not identical. For 2023, the most spoofed brands included Google, Telegram, Microsoft, Visa and Apple .

In these Check Point statistics, Microsoft maintains a leading position as the most frequently impersonated brand, accounting for 38% of all brand phishing attempts. Considering the market share of Microsoft and Google in the Desktop Operating Systems, Cloud and Office productivity, this is no surprise. An interesting observation is the notable rise in the impersonation of LinkedIn, which emerged as a significant target in Q1 2024, accounting for 11% of brand phishing attempts. This indicates a shift in cybercriminal strategies, possibly targeting professional networks to exploit personal and corporate information. In the section on Social engineering through job search platforms we will continue to elaborate on this topic.

ENISA THREAT LANDSCAPE 2024 6.3 TRUSTED ENTITIES IMPERSONATION PHONE CALLS.

Several EU countries have published published alerts , warning about social engineering over the phone along with USA-based CISA . This is an example of the type of phishing called vishing, which occurs over phone calls, with attackers impersonating a trusted entity, trying to persuade victims to reveal sensitive information. Scammers were impersonating CISA employees, demanding their victims send money. One month earlier, the US Federal Trade Commission (FTC) released a similar press release, warning about phone-based social engineering . According to this release, the median loss to FTC impersonators increased from 3,000 USD in 2019 to 7,000 USD in 2024.

According to the 2023 Internet Crime Report, published by the Federal Bureau of Investigation (FBI), more than 14,000 complaints were filed concerning government impersonation scams. This represents an increase of 63% in reported cases compared to previous years. The financial impact of these schemes is equally alarming, with reported losses amounting to almost 400M USD. It is important to note that these figures only account for incidents involving government institutions within the United States and are based solely on reported cases, likely underestimating the true scale of the problem. Note that these impersonation calls are still manual and performed by a human. With the rise of AI generated synthetic voices, this type of attack can become more automated and grow to a much larger scale.

The European Union Agency for Law Enforcement Cooperation (EUROPOL) maintains an online list with links to the law enforcement agencies of each member state, where cybercrimes can be reported. However, for Europe, there is currently no consolidated data publicly available regarding the number of social engineering incidents through the impersonation of government services.

6.4 SCATTERED SPIDER TARGETED BY LAW ENFORCEMENT

In June 2024, a 22-year-old man from the UK was arrested in Spain for allegedly being part of the cybercriminal group known as Gold Harvest, also referred to as Scattered Spider. This 315 316 operation is said to be a joint operation between the FBI and the Spanish Police . Scattered Spider stands out for its social engineering attacks and distinctive composition compared to typical cybercriminal organisations. Throughout 2023, the group used SMS phishing (smishing), voice phishing (vishing) to harvest credentials, and phone calls towards helpdesks to manipulate support staff into resetting passwords or multi-factor authentication (MFA) for targeted accounts. They also used previous intrusions at telecom companies to perform SIM swaps, enabling interception of one-time password (OTP) codes. The group targeted IT and INFOSEC employees, presumably because of their access to security applications and documentation that facilitate lateral movement and further account compromises. A smaller number of attacks focused on employees with access to financial 317 318 resources .

6.5 SOCIAL ENGINEERING THROUGH JOB SEARCH PLATFORMS

Social engineering attacks are increasingly targeting job listing platforms, exploiting the trust inherent in recruitment processes. Cybercriminals and nation-state actors use advanced social engineering tactics to deceive both job seekers and employers, resulting in financial loss, espionage and compromised security.

ENISA THREAT LANDSCAPE 2024

One of the prominent trends is the creation of fake companies and personas to engage potential targets. Threat actors set up seemingly legitimate businesses with detailed online presences, including websites, social media profiles, and employee personas. These fake entities are used to lure job seekers into downloading malicious software or to infiltrate organisations by getting hired under false pretences. This tactic has been notably used by North Korean groups such as Moonstone Sleet, which used fake companies to trick developers into running malware loaders disguised as skills tests .

Phishing remains a core method. Attackers use recruitment-themed emails and messages that appear highly credible, often personalised with the target's information. These phishing attempts commonly include job offers, interview requests or task assignments that involve downloading malicious files. The ‘Contagious Interview’ campaign by Lazarus exploited these tactics by posing as recruiters to distribute cross-platform infostealers during fake job interviews .

Multi-stage infection chains are used to progressively compromise targets. Initial contact may be benign, such as an email or job application, but subsequent interactions introduce malicious elements. For example, the ‘Dev Popper’ campaign begins with a seemingly legitimate coding task that, when executed, downloads additional malicious payloads, including remote access trojans (RATs) . Furthermore, attackers increasingly tailor their campaigns to specific sectors and roles, such as software development, IT and finance, to maximize the impact of their attacks. The ‘WarmCookie’ campaign, for instance, targets individuals with job offers that seem relevant to their current employment, increasing the likelihood of engagement .

6.6 BYPASSING MFA

Multi-factor authentication is being actively bypassed in social engineering attacks. MFA spamming or bombing consists of repeatedly sending MFA push notification prompts, causing the victim to eventually accept it, inadvertently, or just to be able to use the phone again (MFA fatigue). This type of attack was noticed in March 2024, targeting Apple iPhone (and Watch) users . Cisco Talos investigated their global attack dataset, including 15,000 catalogued pushbased attacks from June 2023 to May 2024. Most push-based attacks were unsuccessful, as they are either ignored or reported by users, and only 5% of the sent push attacks were accepted by users. For the users who did accept fraudulent pushes, it typically did not take many attempts, between one and five push requests. Only a very small number were subjected to a ‘bombardment’ of 20 to 50 requests. On the global scale an interesting finding is that most fraudulent push attempts were sent between 10:00 UTC and 16:00 UTC, aligning slightly ahead of US working hours, and mirroring the target users' working day routines .

There has also been a rise in compromises of cloud-based identities secured with multi-factor authentication (MFA). Particularly concerning is the growing use of web proxy or adversary-inthe-middle (AiTM) phishing pages, which can bypass many MFA implementations by stealing sensitive session tokens. Attackers commonly use credential-harvesting forms or phishing pages to collect login details from their victims. These phishing sites, designed to mimic popular login portals, pass the user’s credentials and MFA codes to the attacker. AiTM phishing pages go beyond standard credential-harvesting techniques by using infrastructure designed to defeat typical MFA methods. Unlike traditional phishing forms, AiTM pages function as a reverse web

ENISA THREAT LANDSCAPE 2024

proxy, sitting between the victim and the legitimate login portal, intercepting not only credentials and MFA codes but also the critical post-authentication session token.

6.7 CALL-BACK PHISHING

In last year’s ENISA ETL report, we discussed call-back phishing as a hybrid technique combining standard phishing or spear-phishing with vishing, mainly used to bypass technical restrictions when sending a malicious link or file, and to improve the success rate of a spearphishing campaign by increasing the perceived trustworthiness. For example, the attackers include a phone number into a phishing e-mail, which makes the victim less likely to consider it spam and, thus, the victim is lured into calling .

In November 2022, Palo Alto identified the Luna Moth call-back phishing campaign and associated it to the Silent Ransom Group threat actor . An FBI notification from November 2023 states that since the previous June, the Silent Ransom Group (SRG) has been conducting callback phishing data theft and extortion attacks, by sending victims a phone number in a phishing attempt, usually relating to pending charges on the victims’ account .

An analyst publication details how these call-back methods are used by different actors and that they are powered by fraudulent call centres for the delivery of the initial malicious payload .

6.8 THE USE OF ARTIFICIAL INTELLIGENCE IN SOCIAL ENGINEERING CAMPAIGNS

The use of generative AI has been normalised for end-users and malicious actors. The quality of generated text, images, audio and video has increased strongly over time. Generative AI supports the creation of tailored phishing campaigns, where attackers leverage open-source information from their victims, to create luring and convincing bait text.

Another use case for threat actors is the generation of deep fakes, synthetic images, audio and videos that are almost indistinguishable from reality. In the section on whaling and vishing, we already mentioned the social engineering case where a finance worker transferred $25M USD after being in a video call with his CFO and other employees. However, the malicious actor used deepfake technology and all participants of the call were in fact synthetic generations. Today, indeed, threat actors can clone human speech and audio to carry out this type of attack.

Last year’s ETL report already warned about the potential of generative AI on the cybersecurity landscape. Back then, real-time deepfake tools were not good enough to be used in a social engineering campaign. This year, based on the current number of incidents, the impact is still limited, but we have a first incident involving convincing generated synthetic video. According to CrowdStrike, a Chinese information operations campaign took place in 2023, likely using images produced using generative AI, and achieved significant engagement on major social media platforms. Besides State-nexus actors, hacktivist groups started using generative AI last year to develop a spam tool for promoting pro-Azerbaijan messages ..

ENISA THREAT LANDSCAPE 2024 ENISA THREAT LANDSCAPE 2024

7. THREATS AGAINST DATA

Today, in fact, we live in an interconnected society where cloud, edge and IoT technologies and applications produce huge amounts of data every second . Threats against data aim to block access to data and manipulate (e.g. poison) data to interfere with system behaviour.

A data breach is defined in the GDPR as any breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorised disclosure of or access to personal data transmitted, stored or otherwise processed (article 4.12 GDPR). Technically speaking, threats against data can be mainly classified as data breach or data leak. Though often used as interchangeable concepts, they entail fundamentally different concepts that mostly lie in how 334 335 they happen .

Data breach is an intentional cyber-attack executed by a cybercriminal to gain unauthorised access to release sensitive, confidential or protected data. In other words, a data breach is a deliberate and forceful attack against a system or organisation to steal data.

Data leak is an event (e.g. due to misconfigurations, vulnerabilities or human errors) that can cause the unintentional loss or exposure of sensitive, confidential or protected data. It does not consider intentional attacks and is sometimes called data exposure.

In addition to data leaks and data breaches, the increasing adoption of ML/AI models at the core of novel distributed systems and decision-making, and the recent spread of large language models (LLM) and generative AI (see Section 7.8 for more details), put data manipulation under the spotlight. Data manipulation attacks modern systems affecting the accuracy of their results either at training (i.e. data poisoning) or inference (i.e. adversarial attacks) time, undermining trust in IT/production systems and society overall, as follows.

Data manipulation is a category of attacks that aims to manipulate trustworthy data into untrustworthy, bugged data, targeting the accuracy and performance of ML/AI as well as the perception of reality by people. It includes data poisoning, training-time attacks that manipulate the training set to reduce the accuracy of the trained model or cause the misclassification of specific data points at inference time, adversarial attacks, inference-time attacks that consist of specially crafted data points that are routed to the ML model to cause a faulty or wrong inference (misclassification) , and information manipulation, an intentional attack that creates or shares false or misleading information, targeting people’s perception of a specific event.

Threats against data consistently rank high among the leading threats in the ETL and this trend continued during the reporting period of the ETL 2024 report . In the last few years, adversaries explored a series of new techniques, and exploited the increasing online presence and use of online services by the general public, as well as the increasing migration to cloud computing and the pervasiveness of ML/AI solutions and models. As already observed in ETL2022 and ETL2023, identity theft is one of the major data breach attacks (in terms of impact and value), where malicious actors use stolen personal data to impersonate a user and cause damage to a target system. Moreover, given the significance of (private and sensitive) data, adversaries are combining more advanced threats to data, such as phishing, ransomware or

ENISA THREAT LANDSCAPE 2024

supply chain attacks as well as distributed denial of services and information manipulation. Also, pushed by cloud enhancements, the intended target of a data breach can be separated four, five or six degrees from the real target system/software . Finally, given the massive role assumed by ML/AI models in the operations of modern systems, adversaries are focusing on decreasing the accuracy and performance of ML/AI models by launching new attacks, including data poisoning and prompt injection, which focus on generative AI and LLMs as preferred targets.

During this reporting period, we witnessed an increase in the number of reported data compromises (78% increase with respect to 2022) and individuals impacted . In this context, 340 341 342 we observed an increase in the exploitation of vulnerabilities pushed by MOVEit and the impact of system and human errors that more than tripled in 2023 .

Following up the overall cybersecurity landscape overview in Chapter 1, the following Figures (figure 35 and figure 36) provide a deeper insight into the timeline of observed incidents related to data threats during the reporting period, as well as their break down by sectors and by geographical spread.

Figure 35: Time series of major incidents observed by ENISA (July 2023 - June 2024)

ENISA THREAT LANDSCAPE 2024

Figure 36: Break down of Sectors by threat type and region

7.1 TRENDS

Data becomes an invaluable target for cybercriminals who may want to affect the operations of a system or obtain financial gain. Since 2004, the total number of breached accounts has reached 17.2 billion (number accessed 18 June 2023), with approximately 6.5 billion being unique email addresses according to Surfshark. In more detail, each email address is breached three times on average with 82 unique addresses breached per 100 people and 215 accounts breached per 100 people on average. These numbers are on an increasing trend, confirming Microsoft’s statement in 2022 that: Data breaches are inevitable .

Data threats in general and data breaches in particular are widening, targeting almost all organisations and populations. In 2023, ITRC reported a record in the number of reported data compromises in the USA (see Section 7.3 for more details). Data breaches, particularly data exfiltration, are increasing in speed, with data exfiltrated in hours, not days. The median time in 45% of the cases for non-extortion attacks is less than a day .

Thales reported in its 2024 data threat report that 93% of respondents (3,000 organisations worldwide) observed increased data threats. Also, Thales discussed the centrality of compliance claiming that, in 2024, organisations failing a compliance audit reported a breach history in 84% of the cases, 31% with a breach in the previous 12 months. By contrast, organisations passing compliance audits had a breach history in 21% of the cases, with 3% reporting a breach in the previous 12 months.

According to IBM Security, the mean time to identify and contain breaches is stable at 277 days, with a decrease of 1.45% (3 days) in the mean time to identify a breach and an increase of 4.11% (3 days) in the mean time to contain a breach .

7.2 COSTS OF A DATA BREACH

According to the Cost of a Data Breach Report 2023 the average total cost of a data breach increased by 2.3% from USD 4.35 million in 2022 to USD 4.45 million in 2023, with a total increase of 15.3% since 2020 and a continuous increase since 2017 (except for 2020). At the same time, a similar trend was observed for the cost of a single record, reaching USD 165 in 2023 (USD 164 in 2022), with an increase of 10.3% since 2020, the only year with a cost

ENISA THREAT LANDSCAPE 2024

decrease. In regards to the EU , in Germany alone the damage caused by these attacks has risen by around 29 percent from 205.9 billion euros to 266.6 billion euros. This also exceeds the previous record of 223.5 billion euros from 2021.

Extensive use of security AI and automation reduces the average total cost of a data breach by USD 1.76 million, and the time to identify and contain a breach by 108 days. The average cost also decreases when a DevSecOps paradigm and incident response (IR) planning and testing are used .

Observed costs change according to the region impacted. The first three spots remained the same for 2022, with the USA, Middle East, Canada having an average cost of USD 9.48 million, USD 8.07 million, and USD 5.13 million, respectively. The highest in Europe is Germany with USD 4.67 million in the fourth spot. According to Experian, the USA and Canada are also among the most targeted countries, with the UK reaching the thrid spot .

7.3 IDENTITY THEFT AND SYNTHETIC IDENTITY

The adage identity is the new perimeter has been well received by security experts and practitioners and reflects a significant shift in the approach to cybersecurity. Traditionally, organisations relied heavily on network perimeters—firewalls, secure gateways and other boundary defences—to protect their digital assets. However, as the nature of work has evolved with cloud computing, remote work and mobile devices, these traditional boundaries have become less relevant. Instead, the focus has shifted towards identity as a critical security aspect.

In this context, identity abuse, theft and fraud as well as the use of stolen credentials are among 351 352 353 354 the most important sources of concern and actions at the roots of data breaches . .

The problem of identity abuse is further complicated by the complexity of identity management that mixes i) workforce identity and access management (workforce IAM) and ii) customer identity and access management (CIAM) and by the increasing reliance on cloud 356 357 resources (see Section 7.7 for more details). According to Thales , 16% of all accesses are done by external customer identities. Furthermore, Verizon links the decrease of 16% in the total number of individuals impacted to an increasing trend in which attackers use specific information and identity-related fraud and scams .

This landscape is further worsening due to the increasing evidence that identity criminals are pairing stolen personal information with Generative AI tools and LLMs . The goal is to make phishing and social engineering attacks more effective and of higher quality, able to target specific businesses or individuals. In this context, a new wave of identity crimes is emerging led by impersonation and synthetic identity.

7.4 DATA BREACH NOTICES AND REGULATORY REQUIREMENTS

In ETL2023, we observed a substantial decrease in the number of data breach notices, resulting in an important lack of transparency. If almost 100% of notices mentioned attack vectors or details in 2018-2020, decreasing to 93% in 2021, in 2022 this number took a huge hit

ENISA THREAT LANDSCAPE 2024

to 58%. This trend accelerated in 2023 . The number of breach notices lacking information about the root cause of an attack nearly doubled year-over-year (more than 98%), with more than 1,400 public breach notices missing information about an attack vector in 2023, 716 in 2022. In this context, only 54% of notices come with actionable information of a data breach; the probability that public companies are hiding actionable information is higher.

Comparing figures in the USA and Europe a crisp difference in the approach to notification emerges with an average of 12.3 data breaches reported each business day in 2023 in the USA, 912 reported each business day in 2022 in Europe . One possible reason is that in the USA there is no single definition of data breaches requiring a notice, often mandated in state law, in contrast with the GDPR in Europe. On top of that, the Federal government in the US has its own set of terms and requirements, adding complexity and making compliance difficult and costly. In Q1-2024 , 68% of year-on-year data breach notices in the USA did not include the root cause, while the total number of notices almost doubled year-on-year.

Market uncertainty, new regulatory requirements, and geopolitical tensions have added substantial risks to data (breach) management and protection . In this context, regulations and laws continuously evolve, adding further complexity to data breach management. For instance, in July 2023, the US Securities & Exchange Commission released rules requiring registrants to disclose material security events; in the same period, the EU adopted the EU-US Data Privacy Framework (DPF), as a successor of Privacy Shield Framework (2015) and US-EU Safe Harbor Framework (2000). Different guidelines and regulations about artificial intelligence are also coming, such as the first European AI Act. In this complex environment, Wipro cybersecurity analysed the stringency of data privacy laws in 23 countries around the world according to data breach notification requirements and overseas data transfer restrictions. Their findings show that 70% of countries demonstrated greater stringency in breach notification laws, while 17 countries (74%) demonstrated stringency in international data transfers.

7.5 CLOUD COMPUTING AND DATA BREACHES

Also in this reporting period, the fundamental role of cloud computing as a preferred solution for application and data distribution and delivery requires a careful consideration of data breach 365 366 367 368 369 370 attacks in the cloud . A total of 47% of the data in cloud is in fact sensitive . Multi-cloud adoption is decreasing slightly from an average number of cloud providers of 2.26 per respondent last year to 2.02 this year, while still showing a substantial impact with 51% having two cloud providers and 25% having three cloud providers . Banking, financial services, and insurance respondents moved from an average of 2.02 cloud providers to an average of 2.03.

Thales in its 2023 Data Threat Report: Global Edition reported cloud assets such as SaaS applications, cloud-based storage, and cloud infrastructure management are the biggest targets for attack. In particular, 31% of respondents prioritised SaaS applications as the leading attack target in the cloud, followed by cloud storage (30%) and cloud management infrastructure (26%). In this context, a major cause of data breaches in the cloud is still the human factor. In addition, Thales in its 2024 Cloud Security Study: Global Edition observes that 44% of

ENISA THREAT LANDSCAPE 2024

respondents reported an attack compared to 14% in the previous year . In more detail, user error is at the first spot with 31% and failure to apply multi-factor authentication to privileged accounts reaches a substantial 17% . Exploitation of known vulnerabilities is at 28% and the exploitation of zero-day/new/unknown vulnerabilities is at 24% . According to PaloAlto networks, 76% of organisations do not enforce MFA for console users, and 58% of organisations do not enforce MFA for root or admin users . Also, Cloud Security Alliance claimed that 55% of organisations in its survey stated they recently experienced a SaaS security incident, which resulted in ransomware, malware, data breaches, and more .

According to IBM, data stored in the cloud were a frequent target of data breaches in 2023 . 82% of all data breaches involved data stored in the cloud, with 39% of data breaches spanning across multiple environments (e.g. cloud and on premises) and 27% targeting data stored in the cloud only. Data breaches involving the public cloud and multiple environments have higher costs (USD 4.75 million and USD 4.57 million respectively) than attacks on private cloud and on premises (USD 3.98 million and USD 3.99 million respectively). Similarly, the time to identify and contain a data breach in the public cloud (276 days) and multiple environments (291 days) are larger than the time required on premises (232 days) and in the private cloud (235 days).

To conclude, Cloud Security is a top priority and concern both now (65%) and in the future (72%), the first driver for digital sovereignty and a challenge to compliance and privacy .

7.6 AI AND THE SURGE OF AI CHATBOTS: SOURCE AND TARGET OF ATTACKS

The spread of (generative) AI and ML at the core of modern IT systems makes data poisoning attacks quite popular. Data poisoning attacks are becoming the most critical vulnerability and threat in (generative) AI and ML, since attackers have access to greater computing power and 380 381 382 383 new tools , making the manipulation of elections and data breaches possible .

The disruptive impact and the exponential adoption of generative AI chatbots such as OpenAI ChatGPT, Microsoft Copilot and Google Bard, all built around data sharing and analysis, 384 385 continued in 2023 further shaping how we work, live and play . AI chatbots, as well as large language models, require huge amounts of data to be trained properly and achieve highquality data generation.

AI chatbots are, at the same time, a powerful tool in the hands of cyber-attackers aiming at data breaches, a powerful tool in the hands of cyber defenders (GenAI for security), and a preferred target for cybercriminals as they are very susceptible to prompt injection and data poisoning, 386 387 388 389 390 such as malicious data injection into the training datasets (security for GenAI) . As already reported in ETL 2023, a new wave of risks is coming, requiring global cooperation and discussions on inclusive AI governance, as stressed during the G7 summit in 2023 . In response to this, the EU has put forward a proposal to regulate AI – the so-

ENISA THREAT LANDSCAPE 2024

called AI Act . The proposal has a risk-based approach centred on people that evaluates, among other criteria, the risks posed by AI systems to health and safety, or the fundamental rights of natural persons, and imposes obligations accordingly. Other countries, such as China 393 394 and the USA, are also working on regulating AI .

Netskope in its report Cloud & Threat Report: AI Apps in the Enterprise shows a huge trend in the sharing of sensitive data in generative AI chatbots. Source code is the most common type of sensitive data shared in ChatGPT, 158 incidents per 10,000 users a month, followed by regulated data (e.g. financial and healthcare data, PII), intellectual property excluding source code, and passwords and keys, usually embedded in source code .

In this context, Amazon's Q generative AI chatbot possibly experienced the leaking of confidential data (e.g. the location of AWS data centres) and also suffered from severe hallucinations . Similarly, ChatGPT leaked sensitive user data as a result of a possible 402 403 hack . Samsung banned the use of generative AI from its premises .

Finally, generative AI can be used as a supporting tool for both attackers and defenders. According to the UK National Cyber Security Centre : Artificial intelligence (AI) will almost certainly increase the volume and heighten the impact of cyber-attacks over the next two years. It is used as a support for malicious attacks such as phishing, malware generation and 405 406 misinformation . More in detail, hackers are using GenAI to create new zero-day ransomware and malware, improve the quality of their artifacts during phishing attacks, as a personal assistant to train hackers themselves, and to support the evasion of defence systems and the generation of deepfakes .

On the other side, AI can also be used to detect and respond to AI threats, such as data breaches, malicious content creation, and AI bias . However, a human-in-the-loop is

ENISA THREAT LANDSCAPE 2024

mandatory to oversee important decisions in the detection and response to a given threat . Also, although the adoption of generative AI is clear among organisations, only 21% employ usage policies, just 38% are mitigating their cybersecurity risks and 28% are mitigating their compliance risks .

7.7 ADDITIONAL TRENDS

• 67% of breaches have been reported by a benign third-party or by the attackers themselves. In the latter case, the cost of a breach rises by USD 1 million compared to internal detection (which counts for 33% only of all reports) . • The adoption of high levels of DevSecOps reduces the cost of a data breach by USD 1.68 million, IR planning and testing by USD 1.49 million . • The cost of a data breach increases by USD 1.26 million in critical infrastructure organisations . • Mega breaches, attacks with more than one million compromised records, are rare but have a huge impact. For instance, in France, an attack on France’s Employment Agency could have affected users who registered over the past 20 years, representing the potential exposure of the data of 43 million users . However, in 2023, their cost decreased reaching USD 323 million for attacks with compromised records of between 50 to 60 million . • According to Thales, about 70% of enterprises are unable to classify more than 50% of their sensitive data . • In Europe, more than 386 cases of public database leaks were notified in 2023; only 3.4% of them contained passwords. France, Spain and Italy were the most impacted . • According to Crowdstrike : While ransomware remains the tool of choice for many big game hunting (BGH) adversaries, data-theft extortion continues to be an attractive — and often easier — monetisation route, as evidenced by the 76% increase in the number of victims named on BGH dedicated leak sites (DLSs) between 2022 and 2023. • 419 According to Netskope , sensitive data are released to genAI apps as much as eight times per working day. In addition, for every 10,000 enterprise users, an enterprise organisation is experiencing approximately 183 incidents of sensitive data being posted to the app per month.

ENISA THREAT LANDSCAPE 2024 ENISA THREAT LANDSCAPE 2024

8. THREATS AGAINST AVAILABILITY: DENIAL OF SERVICE

Availability is the target of a plethora of threats and attacks, among which Distributed Denial of Service (DDoS) stands out.

Distributed Denial of Service (DDoS) targets system and data availability and, though it is not a new threat (it celebrates its 25th anniversary in 2024), it plays a significant role in the 420 421 cybersecurity threat landscape . Attacks occur when system or service users cannot access relevant data, services or other resources. This can be accomplished by exhausting the system or service and their resources or by overloading the network infrastructure .

In the last few years, the COVID-19 pandemic and recent wars in Ukraine and the Palestinian Territories substantially modified the threat landscape and all of society, with an increase in state-sponsored and politically motivated attacks and attacks on the critical infrastructures of countries. The year 2022 saw a return of the hacktivist (with political motivations) , whose activities increased in 2023 and embraced recent ‘conflicts or tensions’ including Russia- 424 425 426 427 428 429 Ukraine , Taiwan-China and Israel-Hamas-Iran . In this context malicious actors and groups demonstrated an impressive ability to advance their technical skills and better adapt to the new norm.

DDoS attacks have maintained a stable form over the years, though some interesting points on their evolution may be noted. In the last few years, wars had the widest impact on DDoS, monopolising and influencing DDoS like never before. This trend was reinforced this year with the comeback of hacktivism.

During the reporting period, DDoS attacks grew in scale , thanks to the availability of DDoSfor-Hire services and toolsthat reduce the effort of launching DDoS. The trend in the increasing frequency of DDoS attacks also continued, with a predominance of L3/4 (Network and Transport layer according to OSI MOdel) attacks and the trend in using DDoS as a smokescreen to cover other types of attacks. In 2023, the role of cloud computing as a threat vector increased, as it provides a suitable environment for the creation and execution of VM botnets and their corresponding DDoS attacks, which are becoming increasingly advanced, complex and tech-savvy . This complements the evolution of DDoS in the last few years towards mobile and sensor-based scenarios, where the availability of devices and sensors have become a preferred target of attack due to their limited resources (e.g. battery).

ENISA THREAT LANDSCAPE 2024

Also in this reporting period, a significant upsurge in Distributed Denial of Service (DDoS) 432 433 incidents became apparent in both numbers and dimensions with the turn of the year , as depicted in Figure 37. This increase is again due to the growing influence of hacktivism among groups opposing various regimes and the ongoing geopolitical tensions worldwide, which have increased in numbers and intensity.

From a regional perspective, the trend observed in 2022 grew in 2023 with a higher proportion of DDoS attacks directed at EMEA in general and European Union (EU) member states in particular, as depicted in Figure 38.

Figure 37: Time series of major Incidents observed by ENISA (July 2022-June 2023)

ENISA THREAT LANDSCAPE 2024

Figure 38: Break down of sectors by threat type and region

8.1 ATTACKS ARE GETTING LARGER, MORE COMPLEX, AND LESS EXPENSIVE

The trend in the increasing frequency, size and complexity (e.g. multi-vector attacks) of DDoS 435 436 437 attacks was also confirmed in 2023 , with thousands of hyper-volumetric DDoS attacks 438 439 at unseen rates . Akamai observed an unprecedented surge in size, with security vendors and their web sites massively attacked by DDoS . At the same time, the increasing spread of cybercrime-as-a-service ecosystem (see Section 1.2), as well as advanced tools , are reducing the cost of launching DDoS attacks at scale .

DDoS reached an average of 1,700 attacks per day according to Microsoft, and 13 million 443 444 attacks worldwide . According to Gcore , attacks of unprecedented power were observed in 2023, with a 100% plus increase in the peaks of attack volume in the last three years, from 300Gbps in 2021 to 1.6Tbps in 2023. The attack duration varied from three minutes to nine hours with an average of about one hour. According to StormWall, the number of attacks increased by 63% pushed by geopolitical tensions and war, with the biggest peaking at 1.4Tbps. Google mitigated the largest attack built on HTTP/2 rapid reset which peaked at 398 million rps .

On the same wave, CloudFlare observed thousands of hyper-volumetric HTTP DDoS attacks in Q3 2023, many of which exceeded 100M rps (the largest at 200M rps, eight times larger than the previous record in 2022 when the average attack rate was 30M rps) with an increase of 65% in HTTP DDoS attack traffic and 15% on all DDoS attacks quarter on quarter . In the same period L3/4 DDoS attacks had a minor increase, reaching 2.1M attacks in Q3. The largest attack peaked at 2.6 Tbps and was a UDP flood launched by a Mirai-variant botnet. Mirai-variant botnet is still a common vector of attack and was also involved in the largest attack in Q4 2023

ENISA THREAT LANDSCAPE 2024

that peaked at 1.9 Tbps . In addition, 2024 started with a massive 4.5 million DDoS attacks 448 449 during Q1, a 50% year-on-year increase . .

In general, most of the attacks are still short (less than 10-20 minutes), small in bandwidth (less 450 451 452 453 than 500mbps), and size (less than 50 pps) . In Q4 2023, 2% of network-layer DDoS attacks lasted more than an hour and exceeded 1GB ps; 1% of the attacks exceeded 1 million packets per second. In this scenario, however, network-layer DDoS attacks exceeding 100 million packets per second increased by 15% quarter on quarter.

8.2 DDOS FOR HIRE SERVICES

DDoS-for-Hire allows large-scale attacks to be launched by unskilled users having access to DDoS services . Providers can launch attacks on their clients’ behalf or provide tools for launching them . DDoS-for-Hire combined with the simplicity of building botnets thanks to the availability of a multitude of insecure devices is a perfect mix for implementing large and disruptive attacks. Larger volumes with greater intensity are pushing the scenario to its extreme .

The dimension of this problem is resulting in an increasing effort in trying to limit DDoS-for-Hire. Europol announced in December 2022 that a joint international law enforcement operation had taken control of about 50 sites that were offering DDoS-for-Hire services to threat actors. The operation called Power Off involved law enforcement from the USA, the UK, the Netherlands, Poland and Germany .

This effort continued in 2023 with the shutdown of 48 DDoS-for-hire service platforms by law 458 459 enforcement, with six people investigated . This activity is vital to reduce the impact of DDoS-for-hire on the ability of an attacker to launch complex and distributed attacks at low cost.

Despite these notable results, the number of DDoS-for-hire platforms is increasing by 20% on a year on year basis . Continuous monitoring and tracking, on one side, and proactive activities for platform shutdown, on the other side, are a necessity to limit the impact of DDoS.

8.3 DDOS AND CYBERWARFARE

2022 was the year of the return of the hacktivist . The DDoS landscape was initially affected by the geopolitical changes introduced by Russia’s invasion of Ukraine on 24 February 2022, which then affected the entire reporting period last year . A significant part of the DDoSrelated attacks concerned this event and involved actors at different layers, from statesponsored to simple users, devoting their resources to the cyberwar.

This year the trend continued and strengthened, maintaining a strong connection with cyberwarfare . In addition to the hacktivism targeting the Russia-Ukraine conflict, this year hacktivism arose in other geographical areas, and especially in the war that followed Hamas’

ENISA THREAT LANDSCAPE 2024

Cyber hacktivism has also been accompanied by protests and demonstrations that escalated into disorders in many countries in the world (including Europe and the US) .

8.4 DOS ATTACKS ON CRITICAL INFASTRUCTURE

With the rise in geopolitical tensions and wars, traditional DDoS attacks have been accompanied by an increasing number of attacks and events that targeted critical infrastructure like ISP and telecommunication providers. Attacks and events include cable cuts, military actions, cyber-attacks, government directed power outages and technical problems . This can all be seen as a kind of DoS on Internet availability.

Attacks are getting larger with 41.3% of shutdowns (117) affecting people in more than one state, province or region. Taking conflicts into consideration, 6 out of 8 shutdowns in Ukraine observed by AccessNow have been caused by Russia; 16 shutdowns in Palestine have all been caused by Israel. Earthquakes in Turkey and Iraq, and floods in Libya were also the causes of shutdowns during natural disasters. CloudFlare also identified air-strikes as a common cause of

ENISA THREAT LANDSCAPE 2024

energy outages and Internet shutdowns in Ukraine and observed several such shutdowns in Palestine from October 2023 onwards .

In addition, Cyber Army of Russia Reborn has been targeting operational technology (OT) in the 481 482 EU and in other countries like Ukraine and USA . In the beginning of the year, the group has taken credit for multiple water utilities in the US, a wastewater plant in Poland, and a hydroelectric dam in France.

Finally, according to CrowdStrike , pro-Palestine hacktivists have targeted critical infrastructure in Israel, including disruptive activity against energy-distribution infrastructure and water pumps. DDoS attacks have also been launched against utility companies.

8.5 DDOS ATTACKS AS A SMOKESCREEN AND HORIZONTAL ATTACKS

DDoS attacks are increasingly used as a distracting tactic, which are followed by more impactful attacks. For instance, in 2022, Imperva observed DDoS attacks followed by Account Takeover attacks (ATOs), Bot attacks or attacks on API endpoints to infiltrate sensitive data: […] how large service disruptions often came in parallel with other attack vectors, where, whether intentional or not, DDoS was used as a smokescreen to pivot the defending team’s attention away from a simultaneous attack, such as an ATO or phishing . This scenario often sees DDoS as a decoy for more serious types of attacks such as espionage, increasing business risks and impacting reputation, compliance and supply chain operations .

This trend was confirmed in 2023 by StormWall who reported a 54% increase in the use of DDoS as a means to distract and by Akamai claiming that attacks on the banking and financial industries were aimed mainly at hitting reputations or distracting security experts while 488 489 ransomware , data theft and cyber espionage attacks were being launched. In 2023, multivector attacks involved more than 14 vectors acted as smokescreens for triple-extortion attacks (see Section 1.6).

8.6 RANSOM DENIAL OF SERVICE (RDOS)

Threat actors continued leveraging Ransom Denial of Service (RDoS) to conduct extortionbased DoS attacks that are financially motivated. RDoS aims to identify vulnerable systems that become the target of the attack and put in place different activities that result in a final request to pay a ransom. RDoS can come in two flavours: i) attack first, ii) extort first. Type i) describes a scenario where a DDoS attack is implemented and a ransom is demanded to stop it. Type ii) describes a scenario where an extortionary letter and proof of harm in the form of a small-scale DoS attack is sent with a demand for a ransom. RDoS attacks are even more dangerous than

ENISA THREAT LANDSCAPE 2024

traditional DDoS since they can be completed even if the attacker does not have sufficient resources .

The simplicity of RDoS attacks and extortion tools built on DDoS-as-a-Service (aka DDoS-for- Hire in Section 1.2) are the basis for the adoption of RDoS . Thanks to DDoS-as-a-Service, in fact, launching a RDoS attack is increasingly simple while it is still difficult to spot its origin. Spreading malware instead requires more effort in terms of time and planning .

According to Unit42 , less than 2% of the ransomware cases are RDoS on the global scale. In fact, more effective ransom attacks are available when the assessed objective of the attacker is financial (coercing payment). Cloudflare also observed a decrease in the number of reported 503 504 RDoS at 8% in Q3 2024 . Finally, according to Akamai , in 2023, gaming and gambling industries were the target of DDoS attacks and triple extortion.

8.7 APPLICATION VS NETWORK ATTACKS

Application attacks have been continuously increasing over the last few years. The role of hyper-volumetric HTTP DDoS attacks has increased since they began in August 2023 with a 505 506 huge wave of attacks built on the HTTP/2 Rapid Reset vulnerability (CVE-2023-44487) . For example, the largest attack Google ever mitigated peaked at 398 million requests per second . However, 2023 saw a drop of 20% in the number of HTTP DDoS attacks with respect to 2022, a total of 5.2 million HTTP DDoS attacks consisting of over 26 trillion requests. This decrease was particularly sharp in Q4 with a decrease of 18% quarter-on-quarter. In 2024, HTTP/2 has been exploited to execute DDoS, especially the HTTP/2 continuation flood . In this context, Microsoft confirmed that its systems were hit by an application-layer DDoS attack launched by hacker group Storm-1359 that caused disruption in Microsoft 365 (including Outlook on the web and OneDrive) and Azure Portal .

By contrast, the number of network-layer DDoS attacks showed a sharp increase of 85% with respect to 2022 with 8.7 million attacks and 80 PB of traffic. Only considering Q4 2023, Cloudflare observed a 175% year-on-year and 25% quarter-on-quarter increase in network-

ENISA THREAT LANDSCAPE 2024

layer DDoS attacks. In this context, DDoS attacks observed a huge increase of 28% in 2023 , 80% year-on-year in Q1 2024 .

2023 saw a comeback of UDP-based attacks, according to Gcore, with UDP floods reaching 62% of the DDoS attacks . TCP floods accounted for 16% and ICMP attacks for 12%. Other attacks, including SYN, SYN+ACK and RST floods, accounted for 10%. QRatorLab confirmed a similar picture with UDP-based attacks reaching 55% of the DDoS attacks in 2023.

CloudFlare presented a stable share between application and network attacks at the end of 2023, the beginning of 2024 where 37% (1.7 million) were HTTP DDoS attacks, 33% (1.5 million) were DNS DDoS attacks, 30% (1.3 million) were other L3/4 DDoS attacks .

8.8 BOTNETS, CLOUD AND DDOS

As discussed in ETL2023 and ETL 2022, the rapid adoption of the cloud and its movement towards edge computing increased the attack surface and the opportunity for cybercriminals . This migration has been further boosted by remote working, online education, business resilience and environmental sustainability initiated by COVID-19.

Today, the cloud is one of the main threat vectors. It is used to build botnets launching DDoS attacks, is a target of DDoS attacks itself and is also used as a defensive mechanism through various tools.According to Microsoft , attackers targeted discounted Azure subscriptions across regions to implement DDoS. Up to 40 regions (with US regions the most exploited at 70%, European ones following at 15%) have been affected by account compromises every month, to build botnets on a global scale. According to CloudFlare, cloud computing boosted the generation of botnets that launch HTTP/2 attacks generating 5,000 times more force per botnet, supporting the generation of hyper-volumetric DDoS attacks with botnets using 5-20 thousand nodes. This compares to IoT-based botnets involving millions of nodes .

IoT botnets, which were the most adopted in 2021 and 2022, are gradually being complemented 517 518 by VM botnets running on the cloud or botnets built on computers and servers , though 519 520 they maintain a remarkable role in DDoS . Botnets have an important role in the DDoS scenario accounting for almost half of the attacks .

The increasing size of DDoS attacks requires increasing power to implement defensive actions from detection to protection . In this context, the role of cloud surge as a primary defence against DDoS due to the need for the scalability and elasticity required to counteract attacks, which have a global reach, necessitates close proximity to attack sources. The cloud is the hosting infrastructure for many DDoS Protection Providers such as for instance Cloudflare, Akamai, Project Shield and AWS Shield to name but a few.

As already remarked, cloud computing can also become the target of an attack. For instance, application-layer attacks can force the cloud resources of a target to scale horizontally . This is slightly different from traditional DDoS attacks and forces victims to employ more resources to counteract service denial. This scenario results in financial loss due to increased cloud bills and,

ENISA THREAT LANDSCAPE 2024

indeed, denial of service could result in the exhaustion of financial resources. In Q4 2023, a massive DDoS attack targeted a European cloud provider. The attack, built on the Mirai botnet, was launched from 18 thousand unique IP addresses and reached a peak of 1.9Tbps.

8.9 DDOS ATTACKS SPREAD

Geographical Spread

The geographical spread of DDoS attacks in 2023, as analysed in Gcore Radar: DDoS Attack Trends, Q3-Q4 2023, indicates that the USA (24%) and Indonesia (17%), followed by The Netherlands (12%), Thailand (10%) and Colombia and Russia (8%) are at the top of the ranking as source countries of DDoS attacks .

The analysis done by Microsoft indicates that the USA (54%) and Europe (14%) are at the top of the ranking as target countries of DDoS attacks, with India moving from second to fifth and the UK relegated to the ninth position .

Cloudflare analysed the geographical spread of DDoS attacks, distinguishing between the 526 527 application (L7) and network/transport (L3/L4) layers. The findings in Q3 2023 , Q4 2023 , and Q1 2024 can be summarised as follows.

• Application Layer (L7) – Source Country: In Q3/Q4 2023, the USA confirmed its lead (15% plus), for the fifth consecutive quarter, followed by China, Brazil, Germany and Indonesia as the most relevant sources of DDoS attacks considering the total amount of traffic generated by application-layer DDoS attacks. In Q1 2024, the USA regained the lead (19.98%) followed by China (7.73%), Germany, Indonesia and Brazil. When comparing the DDoS traffic to the entire traffic in the country, among the biggest countries, China reached the 4th and 7th spot in Q3 and Q4 respectively in 2024, while Argentina reached the 6th spot in Q4 2024.

• Application Layer (L7) – Target Country: When considering the target of a DDoS attack at the application layer, the total amount of traffic, in Q3 2023, put the United States (4.867%), Singapore (3.12%), and China (2.208%) into the top spots. In Q4 2023, Singapore (4%), the USA (3.70%) and Canada (2.24%) were at the top spot considering absolute traffic values, followed by Taiwan (0.64%) with a huge increase of 847% year-on-year and 2,858% quarter-on-quarter pushed by tensions with China. Q1 2024 saw a sharp increase in the USA as a target country at 10.19%, followed by China and Canada at under 4%. When comparing the DDoS traffic to the entire traffic in the country, Singapore and Italy reached the 4th and 5th spots respectively in Q4 2023.

• Network Layer (L3/4) – Source Country: In Q3 2023, the USA still took the first spot as the most relevant source of DDoS attacks, substantially increasing its total attack traffic (by 36.6%). Also in Q1 2024, the USA confirmed its lead by increasing to 40.8%, followed by Germany at only 5.8% . Vietnam (38.14%) was the second largest source of attack traffic in Q3 2023; Paraguay (57.4%) was the second in Q4 2023 and Q1 2024.

• Network Layer (L3/4) – Target Country: In Q3 2023, China reached the top of the rankings in both absolute numbers (29.22% of the total attack traffic), followed by

ENISA THREAT LANDSCAPE 2024

the USA (3.55%), and as a percentage of all the country’s traffic (73%), followed by The Netherlands (35%). In Q4 2023, China maintained the first position both in absolute numbers (45%) followed by Brazil (3.1%) and the Palestinian territories (1.1%), and as a percentage of all the country’s traffic (85.8%), followed by the Palestinian territories (68.4%) and Brazil (61.1%). Q1 2024 saw a monopolisation of the first positions by China (39%) and related countries (Hong Kong 28%, Taiwan 8%). Hong Kong (78.6%) and China (75.4%) took the lead also with relative numbers.

Industrial Sector Spread

When analysing the spread of DDoS across industrial sectors, it is difficult to find a perfect match between different organisations. However, some common facts and trends emerge.

Gcore analysed the most targeted industries in H2 2023 finding gaming (42%) in the first spot, followed by the more traditional financial sector (22%) and telecom (18%) . Potential attacks on the gaming and gambling sector are more frequent but low in power and duration; attacks on the financial and telecom sectors are high in volume with variable length. According to Akamai, DDoS attacks on financial services accounted for 25% of all attacks (66% in EMEA) .

Considering application-layer DDoS attacks, in Q3 2023 , CloudFlare observed that the gaming domain took the lead (5.41%) as the domain with the highest application-layer attack traffic, followed by Internet technology and Internet (4.38%) and cryptocurrency (3.43%). The first three domains also remained at the three first spots in the ranking in Q4 2023 , with cryptocurrency taking the lead. In Q1 2024 , gaming (7.45%) and Internet technology and Internet (4.52%) were in the first two positions, with Marketing and Advertising (2.68%) jumping into third position. Observations of the HTTP/2 Rapid Reset Attack at CloudFlare confirmed the relevance of the gaming domain (18%) which was the target of the largest HTTP DDoS attack traffic . CloudFlare infrastructure (19%) and the VoIP (10%) were the other two domains in the first three spots.

StormWall put the focus on finance, government and services, and retail as the domains most impacted by DDoS attacks with an increase of 108% in the government sector . Similarly, Akamai analysed the financial domain, identified as the largest in terms of the number of

ENISA THREAT LANDSCAPE 2024

attacks, seeing the rise in geopolitical hacktivism and the availability of VM botnets (see Section 541 542 1.8) as the most impactful aspects . In this context, pro-Russian hacker groups (e.g. Killnet, REvil, and Anonymous Sudan) targeted European and US financial organisations causing EMEA to almost double the figures for North America.

Targeted attacks have been launched in connection with the approach of relevant events. For instance, in Q4 2023, a wave of network-layer DDoS attacks targeted retail, shipping and public 543 544 545 relations websites during and around Black Friday and the holiday season . Another impressive growth of 61.839% year-on-year in DDoS attack traffic targeted Environmental Services, especially coinciding with the 28th United Nations Climate Change Conference (COP 28) . The same pattern emerged in February and March 2023, around events such as the UN's resolution on climate justice and the launch of the United Nations Environment Programme’s Freshwater Challenge, showing a growing relationship between environmental issues and cybersecurity. Similarly to what happened to Finland in 2023, Sweden observed a surge of 466% in DDoS attacks after it was accepted into NATO . A 30% increase in attacks in December 2023 was observed in Perú in conjunction with a series of protests against the release of former Peruvian President Fujimori from prison on 6 December. A 50% increase was observed in Poland when the Law and Justice party lost power in government . Finally, 549 550 European Governments were hit by DDoS during election periods . For instance, the Dutch government was the target of two DDoS attacks on 5 and 6 June 2023.

8.10 ATTACK VECTORS

According to CloudFlare , DNS-based attacks were the most common at 47% of all attacks in Q3 2023 and 50.4% in Q4 2023, rising to 60% in 2023 according to Akamai . SYN floods (22% in Q3, 19% in Q4) were in second place, followed by RST floods, UDP floods and Mirai attacks. The mantra reduce, reuse and recycle is also used to use fewer known attack vectors built on older attack vectors, usually UDP-based protocols used to launch amplification and reflection attacks. For instance, mDNS flood saw an increase of 456.4% quarter-on-quarter, CoAP flood of 387.1% and ESP flood of 302.6% in Q3, while ACK-RST Floods increased by 1,161%, CLDAP floods by 515% and SPSS floods by 243% in Q4.

In general, network attacks increased at the end of 2023 by 117% year-on-year . The top three, according to NexusGuard, included NTP amplification attacks, HTTPS Flood and DNS amplification attacks .

ENISA THREAT LANDSCAPE 2024

Similar figures emerged in Q1 2024 with DNS-based attacks reaching 54% of all L3/4 attacks (37% in total), a total of 1.7 million attacks representing 37% of all DDoS attacks . SYN flood, on a decreasing trend (15.3%), was in second place, followed by RST floods, UDP floods, and Mirai attacks. Regarding emerging vectors, Jenkins Flood saw an increase of 826.7%, SNMP flood of 274.4%, and ESP Flood of 169.1%.

HTTP/2 protocol implementation was misused to send hyper-volumetric DDoS attacks built on HTTP/2 Rapid Reset (2023) and HTTP/2 continuation flood (2024) vulnerabilities . In general, CloudFlare observed that about one-third of attacks (37%, 1.7 million) had been built on HTTP crossing 2023-2024 .

As discussed in Section 1.5, DDoS continues to be an attack vector itself for other attacks.

8.11 ADDITIONAL FACTS AND NUMBERS

• According to CrowdStrike , from June 2023 onwards, the CrowdStrike eCrime Index grew significantly, with major spikes between June and August. A sudden increase in observed DDoS attacks was among the major reasons. • According to Microsoft , DDoS attacks on the healthcare sector rose; the overall attack throughput was around 100k packets per second in 99% of the incidents with a peak of 14 million packets per second. • According to Akamai , 30% of the DDoS attacks were horizontal and multidestination attacks, an increase of nearly 50%. • According to Akamai , the Europe, the Middle East and Africa (EMEA) region was the most targeted by DDoS. • According to NexusGuard , 87% of DDoS attacks targeted Windows OS devices with computers and servers becoming the primary target of DDoS (92%). • Horizontal DDoS attacks (aka carpet-bombing attacks), which attack multiple IP 567 568 destinations, grew of 52% in 2023 and accounted for almost 50% of all attacks . • DDoS attacks based on Mirai, a botnet introduced almost 8 years ago, are still very common . • In September 2023, Akamai observed the largest ever DDoS attack targeting a US financial institution . The attack lasted less than two minutes and was a combination of ACK, PUSH, RESET and SYN flood attack vectors, reaching 633.7 gigabits per second (Gbps) and 55.1 million packets per second (Mbps).

ENISA THREAT LANDSCAPE 2024 ENISA THREAT LANDSCAPE 2024

9. INFORMATION MANIPULATION AND INTERFERENCE

Foreign Information Manipulation and Interference (FIMI) describes a mostly non-illegal pattern of behaviour that threatens or has the potential to negatively impact values, procedures and political processes. Such activity is manipulative in character, conducted in an intentional and coordinated manner. Those who carry out such activities can be state or non-state actors, including their proxies inside and outside their own territory . The current chapter focuses on information manipulation and interference regardless of its origin.

As in the 2023 ENISA Threat Landscape (ETL 2023), in this edition we continue to use the term ‘information manipulation’, as opposed to ‘disinformation/misinformation’; this reflects a broader set of potential threats and, more importantly, it puts emphasis on manipulative behaviour, instead of the truthfulness of the content being delivered.

We argue that information manipulation and relevant operations should be considered a cybersecurity threat, since such operations directly affect at least one of the three components of the information security model and in particular that of integrity of information, as well as other cybersecurity principles (such as authenticity and accountability) and leverage on other types of cybersecurity tactics, techniques and procedures .

The figure below shows the timeline of information manipulation events that we have observed throughout the period of reference. The following sections give an overview of identified trends.

Figure 39: Distribution of information manipulation incidents during the period of reference

ENISA THREAT LANDSCAPE 2024

Methodological note for this chapter:

Data: Most of the events analysed have been shared by the European External Action Service (EEAS) Information Integrity and Countering Foreign Information Manipulation and Interference (FIMI) Division. The division focuses on Foreign Information Manipulation and Interference (FIMI) and on activities traceable to specific foreign actors or regions. The incidents of this report have been selected with keywords related to cybersecurity (e.g. phishing, defacement). The majority refers to activities suspected to be linked to Russian actors to different degrees. Data on cyber-related FIMI activities by other actors are not systemically collected. Whereas attribution remains challenging, the narratives and the motivations exhibited by adversaries point to likely foreign threat actors. This is by no means a formal attribution, just a likely provenance. This focus might be due to data collection (focusing on strategic issues), and/or to the geopolitical context, possibly leading to a surge in information manipulation activities and/or in Tactics Techniques and Procedures (TTPs) combining cybersecurity and the manipulation of information. In some cases, observation on other actors from other sources have been inserted, in particular if said actors interacted with the observed infosphere and/or adopted similar behaviours. A brief, more general, analysis from the perspective of Artificial Intelligence has also been included.

Important: This does not necessarily imply that a given incident or source of information is linked to the Russian government or editorially in favour of the Russian government, nor that it has intentionally sought to disinform.

Analysis: This chapter analyses incidents both with the DISARM (DISinformation Analysis & Risk Management) Red framework , describing behaviours for manipulating information, and MITRE ATT&CK Framework. This combined approach was proposed for the first time in the 2022 ENISA-EEAS joint report and used for the first time in the ETL for the 2023 edition. It should be noted that the application of these frameworks, and especially of DISARM, has been further fine-tuned in this year’s edition. For example, the DISARM framework has also been used more extensively to describe the infrastructure underlying the events observed (see in particular section 9.2.4). Also, the quality of the data has improved, for example with more information about related events. For this reason, the comparison with the data of the ETL 2023 should be interpreted as indicating trends, rather than exact increases or decreases in the percentages of tactics or techniques.

ENISA THREAT LANDSCAPE 2024 9.1 TRENDS

By analysing incidents of information manipulation, we have identified several trends: • Information manipulation continues to be a key element of Russia’s war of aggression against Ukraine, although an effort to further localise content and, at the same time, to globalise its presence is observed. • Manipulating information in response of specific news seems to have increased, probably because 2024 has been marked by many major events, elections in particular. Elections have also been the target of self-proclaimed hacktivists, whose presence was also reported in the ETL 2023. • Information manipulation continues to be supported by a widespread digital presence, showing many cases of inauthentic accounts and websites. • AI-enabled information manipulation has been observed, but still on a limited scale.

9.2 OVERVIEW OF TACTICS

In terms of information manipulation, the most recurrent tactic is content development, followed by the establishment of assets and microtargeting .

Table 1: Definitions of the top-3 DISARM tactics (in order of recurrence)

DISARM Tactic Definition

TA06 - Develop Content Create or acquire text, images and other content

TA15- Establish Social Establishing information assets generates messaging tools, including social Assets media accounts, operational personnel and organisations, including directly and indirectly managed assets TA14 – Microtarget Target very specific populations of people

The figure below shows the distribution of the most recurrent tactics according to the DISARM framework. The analysis has been carried out by associating several tactics to each incident. With respect to the ETL 2023, there is an increase in the establishment of social assets and microtargeting .

Figure 40: Distribution of information manipulation tactics according to the DISARM framework

ENISA THREAT LANDSCAPE 2024

According to the MITRE ATT&CK framework, that is from a cybersecurity perspective, information manipulation has been supported mainly by tactics for the development of resources, which amount to more of than half of the tactics used, followed by tactics related to the evasion of defences and impact.

Table 2: Definitions of the top-3 MITRE ATT&CK tactics (in order of occurrence)

MITRE ATT&CK Tactic Definition

Resource Development Resource Development consists of techniques that involve adversaries creating, purchasing, or compromising or stealing resources that can be used to support targeting. Defence evasion The adversary is trying to avoid being detected.

Impact The adversary is trying to manipulate, interrupt, or destroy your systems and data.

Figure 41: Distribution of information manipulation tactics according to the MITRE ATT&CK framework

Figure 41 shows the distribution of the most recurrent tactics. The analysis has been carried out by associating several tactics to each incident. With respect to the ETL 2023, the top tactics

ENISA THREAT LANDSCAPE 2024

have not changed, only their proportion: resource development represented 59% of tactics (52% in the ETL 2023), defence evasion 19% (12% in the ETL 2023) and impact 14% (27% in the ETL 2023). This seems to indicate that malicious actors focus on the establishment of inauthentic accounts (resource development) and the concealment of infrastructure or assets (defence evasion). The decrease in impact tactics (associated with data manipulation) might be explained by the focus on impersonating legitimate entities and creating content from scratch, as opposed to the reframing of existing legitimate content.

In the following sections the most recurrent tactics, for both the DISARM and MITRE ATT&CK frameworks, are broken down into techniques and contextualised into specific trends. Additional trends emerging from the data analysis are also discussed.

9.3 SEIZING THE OPPORTUNITY OF LEVERAGING ON MAJOR EVENTS

The period of reference of this report has been marked by major events that have been promptly exploited for FIMI purposes. In approximately 40% of the events analysed, the DISARM technique of responding to breaking news events marked a significant increase with respect to the ETL 2023, where this technique was used in 27% of events. Breaking news events are events where media attention on a story is heightened. It is noticeable that the timeline of events (Figure 39) does not reflect this trend. Possible explanations are that the information has been manipulated in reaction to more events than in the past either because the capacity of threat actors to react quickly and more specifically has improved and/or because there have been more note-worthy events over the period of observation. We have identified several thematic clusters of such events, in particular revolving around the geopolitical situation and elections.

Geopolitical situation

Russia’s war of aggression against Ukraine remains a catalyst for the FIMI activities observed. As explained in the ETL 2023, while this could be due to a bias induced by the data collection , information manipulation has been an essential and well-established component of 580 581 Russian security strategies . Throughout the period of reference, a shift in the narrative was observed. While in the first year of the war influence operations would be generally intertwined with Russia’s political and military efforts, the focus seems to have moved more distinctly to Ukraine’s allies, sowing distrust between Ukrainian populations and European partners and undermining the support of European citizens for Western military assistance to Ukraine . Besides the war, it seems that pro-Kremlin actors are leveraging on the geopolitical situations beyond EU’s borders and affecting Ukraine’s allies.

Elections

2024 has been widely labelled as the ‘election year’ as more than 80 countries, representing more than half of the world’s population, are voting . The manipulation of information can affect the electoral processes in various way, such as setting the agenda on certain key topics, encouraging abstention or undermining political adversaries . Cybersecurity attacks can also facilitate the creation and spread of manipulated information among the electorate, for example by exfiltrating (or claiming to have exfiltrated) data in order to harm the reputation of an electoral candidate, as well as by carrying out (or claiming to have carried out) attacks affecting the electoral infrastructure to undermine the public’s trust on the integrity of the electoral process . This indeed happened in the period of reference on several occasions. The European Parliament elections, held between 6 and 9 June, have been looked at with particular concern

ENISA THREAT LANDSCAPE 2024

given the complexity of the exercise, encompassing, in practice, the organisation of elections in each of the 27 Member States over a very short time-frame . While no major disruption in terms of information manipulation was registered , some threat actors, including NoName057, have claimed cyber-attacks (DDoS) targeting the internet infrastructure in the EU during the electoral period . This suggests that the trend identified in the ETL 2023, linking selfproclaimed hacktivists with pollution of the information environment, has not disappeared. As to national elections, the EEAS reports that a few days before the Polish 2023 parliamentary elections photos and videos targeting a candidate, seemingly obtained through a previous Ghostwriter hacking operation , were published online by a website previously blocked for releasing leaked emails from Polish politicians, and which was attributed by independent researchers and Polish services to the Russian and Belarusian security services .

Paris 2024 Olympics

Although the Olympics are outside the period of reference of this report, they have already been a recurrent theme in information manipulation campaigns since 2023 . Microsoft reports the detection of several information manipulation operations especially since, in 2023, the International Olympic Committee’s (IOC) decided that Russian citizens would be allowed to compete in Paris but only as neutral athletes. The objectives of these operations are two-fold: on one hand to denigrate the reputation of the IOC and, on the other, to create the expectation of violence breaking out in Paris during the games . VIGINUM, the French governmental agency tasked with the protection against and monitoring of foreign digital interferences, has pointed out similar narratives used in the operation ‘Matryoshka’, whereby fake content impersonating legitimate entities (e.g. media outlets) is shared in a coordinated manner on social media .

9.4 LOCALISED TARGETING AND ON A GLOBAL SCALE

As explained above, microtargeting is the third most recurrent DISARM tactic, with an increase over the ETL 2023. The most recurrent microtargeting technique is the creation of localised content, followed by the purchasing of targeted advertisements (the latter is treated in the next section).

The creation of content appealing to a specific community of individuals can have different forms, such as the development of narratives with a local spin (for example in reaction to events with local relevance, as explained in the previous section), as well as the use of local languages. It has been observed that threat actors seem to have adapted the manipulation of information to specific situations more and more, thus widening their potential for a global outreach.

Since Russia’s full-scale invasion of Ukraine, pro-Russian information manipulation has consistently been conducted in several languages to maximise its exposure. Between September and December 2023, for example, a network of almost 200 ‘information portals’ with similar characteristics and targeting western countries in their local languages has been detected. Moreover, the network appeared to use search engine optimisation to be prompted by more precise and occasional queries referring to current events .

ENISA THREAT LANDSCAPE 2024

Figure 42: Distribution of information manipulation techniques within the DISARM tactic ‘Microtarget’

These efforts also seem to have gradually expanded globally, and to be relying more on social media, probably because the shift in narrative is targeting Ukraine’s supporters (rather than Ukrainians themselves), as well as Western sanctions disrupting the communications of statesponsored media, in particular RT and Sputnik. RT and Sputnik are still influential in parts of Latin America, Middle East and Africa, where Russia also uses using its diplomatic network for the amplification of its narratives and local information outlets have been established as well .

China is also expanding its FIMI activities, with operations being tracked all over the world, employing, among others, bots, trolls and coordinated campaigns with inauthentic social media accounts . According to Microsoft, Chinese-affiliated covert propaganda operates at a scale unmatched by other malign influence actors deploying thousands of accounts across dozens of websites spreading memes, videos, and articles in multiple languages . China is also experimenting with Artificial Intelligence, with deepfake news anchors and large language models (LLMs) to generate texts in languages such as Japanese and Korean that are posted across social media platforms .

9.5 INAUTHENTIC CHANNELS AND BEHAVIOUR NURTURING EXPOSURE AND CONFUSION

The ETL 2023 pointed to a very widespread digital presence to maximise the exposure of adversarial operations. This trend has continued and likely strengthened over the last year.

Resource development, that is the creation or acquisition of resources that are used by adversaries to support targeting, is the most recurrent MITRE ATT&CK tactic. Coherently, the second most recurrent DISARM tactic, after the development of content, is the establishment of social assets, intended as information assets. The DISARM framework allows a closer look on the type of resources or assets that have been developed or established. The break-down of

ENISA THREAT LANDSCAPE 2024

the DISARM techniques within the DISARM tactic ‘Establish social assets’, shows that assets included mostly inauthentic accounts, sometimes grouped in networks of fake profiles, and websites.

Figure 43: Distribution of information manipulation techniques within the DISARM tactic ‘Establish social assets’

Inauthenticity supports information manipulation both by giving threat actors the possibility to impersonate legitimate entities and rendering the detection of FIMI activities more difficult.

Impersonation of legitimate entities was a common trend in the events analysed, commonly implemented through typo-squatting websites to mimic legitimate media outlets or entities (e.g. by slightly altering the URL of a known news website) or by forging content that appears as originating from specific organisations (e.g. by using the logo of a known news outlet on a forged video). Threat actors continue to adopt work-arounds to reach European audiences. As seen in section 1.2, the MITRE ATT&CK tactic ‘Defence evasion’ is the second most recurrent MITRE tactic (19% of tactics, increasing from the ETL 2023’s 12%) and, within that tactic, masquerading is the most common technique. Masquerading is defined by MITRE ATT&CK as the manipulation of an artifact’s feature to make it appear legitimate, (and) is used as the main technique to evade defences and avoid being detected . The sustained introduction of sanctions targeting FIMI activities by the EU in the last two years and possibly the entry into application at the beginning of 2024 of the Digital Services Act might contribute to explaining this increase. It is noteworthy that some of the observed typo-squatting cases seem to belong to the infrastructure revealed by VIGINUM already in 2023 as serving the so-called DoppelGänger or Recent Reliable News (RRN) campaign. As reported in the ETL 2023, in 2022 and 2023 VIGINUM had observed the registration of 355 domain names impersonating the identity of media outlets in France and in nine states in Europe, the Americas and the Middle East. This

ENISA THREAT LANDSCAPE 2024

campaign was assessed in April 2024 as still on-going and its infrastructure as still active . Another observed way to avoid detection when exploiting inauthenticity is through a combination of targeted advertising and URL redirection. The EEAS has observed that malicious actors, in order to circumvent the efforts of platforms to limit access to sanctioned websites, use targeted advertising on platforms to disseminate the URLs of webpages, whose source code has been manipulated so it redirects visitors to blocked domains automatically .

The cases observed show that there is coordination among inauthentic accounts and websites, with cross-posting and flooding the information space being the most used technique to maximise the exposure of manipulated information. Interactions among accounts and websites create the illusion of an authentic discussion and, the same time, obfuscate the origins of FIMI content . For example, the Matryoshka campaign mentioned above uses artificial or the automated dissemination of content, involving a first group of accounts posting fake content on a platform and a second one spreading it by ‘quoting’ it in response to posts by media outlets, public figures and fact-checkers.

9.6 AI IMPACT ON INFORMATION MANIPULATION REMAINS LIMITED (FOR NOW)

In the last three editions of the ETL, AI-enabled information manipulation has been looked at with concern. In particular, the ETL 2023, drafted in the wake of the release of multiple publicly available and widely used AI chatbots, summarised the potential impact of AI on the ‘ABC’ of information manipulation campaigns , namely the actors waging the campaigns, their behaviours and the content. It has been observed that AI has impacted these dimensions on a non-negligible, probably evolving, but still relatively limited, scale: • Actors: As noted in section 2.2.9 some threat actors are experimenting with AI for information manipulation. The effectiveness of AI-supported campaigns has been disputed, however, and it seems that this is rather an exploration phase to assess how AI can be exploited in this context, and evolution is expected . • Behaviour: The extent to which AI is used to disseminate content is not fully clear, although it is happening. For example, NewsGuard has identified over 1,000 AIgenerated news and information sites operating with little to no human oversight . OpenAI has also reported on malicious actors using their models to debug code, seek advice on social media analysis, and fake engagement . • Content: Unsurprisingly, it seems that AI has been used more extensively for content generation. In the cases analysed, AI-generated text, audio, images and videos have all been observed. The DFR Lab has collected a list of AI-generated content since the Russia’s invasion of Ukraine, also including, in November 2023 deep-fake videos of the then-Ukrainian Commander-in-chief .

All the above, seems to mark a progression in the use of AI for FIMI activities, but the full range of predicted consequences has not yet materialised.

ENISA THREAT LANDSCAPE 2024 ENISA THREAT LANDSCAPE 2024

A ANNEX: MAPPING TO MITRE ATT&CK FRAMEWORK

RANSOMWARE ENISA THREAT LANDSCAPE 2024 ENISA THREAT LANDSCAPE 2024 MALWARE (PEGASUS FOR ANDROID) ENISA THREAT LANDSCAPE 2024 SOCIAL ENGINEERING ENISA THREAT LANDSCAPE 2024 THREATS AGAINST DATA DATA EXFILTRATION ENISA THREAT LANDSCAPE 2024 THREATS AGAINST AVAILABILITY (DDOS) THREATS AGAINST AVAILABILITY- INTERNET THREATS ENISA THREAT LANDSCAPE 2024 INFORMATION MANIPULATION AND INTERFERENCE SUPPLY CHAIN ATTACKS ENISA THREAT LANDSCAPE 2024 ENISA THREAT LANDSCAPE 2024 ENISA THREAT LANDSCAPE 2024

B ANNEX: RECOMMENDATIONS

Our recommendations are mapped to the security measures that are part of international standards i.e. ISO/IEC

27001:2022 , NIST Cybersecurity Framework (CSF) v2.0 , used by organisations in the various business sectors.

RANSOMWARE ENISA THREAT LANDSCAPE 2024 ENISA THREAT LANDSCAPE 2024 MALWARE ENISA THREAT LANDSCAPE 2024 ENISA THREAT LANDSCAPE 2024 SOCIAL ENGINEERING ENISA THREAT LANDSCAPE 2024 ENISA THREAT LANDSCAPE 2024 ENISA THREAT LANDSCAPE 2024 THREATS AGAINST DATA ENISA THREAT LANDSCAPE 2024 ENISA THREAT LANDSCAPE 2024 ENISA THREAT LANDSCAPE 2024 THREATS AGAINST AVAILABILITY ENISA THREAT LANDSCAPE 2024 ENISA THREAT LANDSCAPE 2024 ENISA THREAT LANDSCAPE 2024 INFORMATION MANIPULATION AND INTERFERENCE ENISA THREAT LANDSCAPE 2024 SUPPLY CHAIN ATTACKS ENISA THREAT LANDSCAPE 2024 ENISA THREAT LANDSCAPE 2024 ENISA THREAT LANDSCAPE 2024 ENISA THREAT LANDSCAPE 2024 ENISA THREAT LANDSCAPE 2024

-0 75 -6 04 -92 -92 978

ABOUT ENISA

The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu.

ISBN 978-92-9204-675-0 DOI: 10.2824/0710888