Of the many reports created by Cyble’s talented team of threat researchers this year, seven stand out for their unique and comprehensive insight into the contemporary threat landscape.

We’ll examine some of the key takeaways from the reports, including the changing nature of cyber threats and some surprising solutions readers may not have considered.

Here, then, are insights from seven key Cyble research reports from 2024 that you shouldn’t miss, from broad trends to sector-specific threats that affect us all.

Brand Impersonation and Counterfeit Products

E-Commerce and Brand Monitoring examines the underappreciated risks of counterfeit products and brand impersonation. It includes statistics and case studies that should disturb companies and consumers alike.

Two data points underscore the risks for everyone: 70% of consumers have unknowingly purchased counterfeit products online within the last year, and the average company loses almost $4 billion a year in sales because of counterfeit products.

The report examines the most targeted sectors and methods – and discusses detection technologies, solutions, and actions that can help address the problem.

How Threat Intelligence Became a Core Security Technology

The Year in Cyber Threat Intelligence is a comprehensive look at threat intelligence’s emergence as a central cybersecurity technology, including eight mergers that have remade the sector and revealed its strategic importance even for established security vendors.

The leading threat intelligence platforms have evolved into external attack surface management (EASM) solutions that address risks from the network perimeter to the cloud and beyond. Harnessing AI and vast computing resources, these solutions power a growth rate that’s more than twice as fast as the cybersecurity market as a whole.

Along the way, you’ll get insights into threat intelligence use and features you might not know about, including a few practices that can prevent major cyberattacks before they happen.

Healthcare’s Tough Year

Healthcare cyber incidents in 2024 got bigger and more dramatic than ever before, with crippling ransomware attacks and massive data breaches becoming all too common.

Cyble’s mid-year Healthcare Threat Landscape report looks at incidents from the first half of 2024 – and draws important big-picture inferences and trends from the data. One critical insight: Dark web monitoring is an underappreciated tool for detecting credentials, access, and data leaks before they become much bigger cyberattacks and issues.

The report looks at 10 cases where healthcare access credentials were offered for sale on the dark web. Such breaches can be an important indicator of future attacks for any organization, but they can be particularly dangerous in the healthcare sector. The report also looks at vulnerabilities, data exposures, and ransomware attacks that hit the sector this year.

Medical Device Insecurity

A second healthcare report from Cyble is also worth reading for its insights into the unique systems, devices and challenges that make healthcare security so difficult – and breaches so expensive. In fact, healthcare data breaches are more than 50% more expensive than breaches in any other industry.

Vulnerability Management in Healthcare IoT Devices reveals why healthcare security is so difficult, with a sprawling array of unsupported and insecure devices providing critical patient care – as well as ready access for hackers. Here are some of the disturbing data points from the report:

• 75% of infusion pumps have unpatched security flaws.
• 83% of medical imaging systems run on unsupported operating systems.
• 98% of medical IoT device network traffic is unencrypted.
• Over 50% of hospital IoT devices are vulnerable to attack.
• Medical IoT devices were the root cause of 21% of all ransomware attacks in the healthcare sector.
• Only 52% of companies conduct regular security audits for healthcare IoT devices.

You’ll come away from this report with new insight into healthcare security challenges – along with potential solutions.

Software Supply Chain Risks and Controls

Software supply chain attacks have become a near-daily occurrence, and attacks that come through trusted partners are particularly dangerous because of their privileged access to an organization’s data and environment.

Cyble’s Supply Chain Threats report looked at the many ways that supply chain attacks and vulnerabilities can occur, along with an extensive list of security controls organizations can use to reduce those risks.

The use of open-source components in commercial software adds to those risks, creating an opening for malicious packages and open-source vulnerabilities to enter the commercial supply chain.

As any IT vulnerability from a trusted supplier could be considered a supply chain risk, the section on controls is particularly important. A must for understanding our increasingly interconnected threat landscape.

Financial Cybersecurity

The financial sector was covered in multiple Cyble reports this year, but one stands out above the rest: Cyber Threat Intelligence for Financial Institutions is an exhaustive look at the threats facing financial services companies – along with solutions.

The nearly 5,000-word report enumerates the attack types, vulnerabilities, targets, regions, and threat groups that place the industry at high risk of attack – along with what to expect for threats, controls, and regulatory and compliance pressures in 2025. A must-read for anyone who depends on this vital engine of economic growth.

Transportation Security

The Transportation and Logistics report examines the vast cybersecurity risks that threaten to disrupt transportation and shipping – risks that have grown substantially with automation and AI.

The report looks at the specific vulnerabilities, threat groups, and hacktivists that target the transportation sector, along with the attack types the industry faces.

The report examines eight technologies that can help mitigate those risks. You’ll gain a greater appreciation for the many physical and geopolitical risks that transportation services must negotiate while getting people and goods to their intended destinations.

What’s Next from Cyble Threat Researchers?

In addition to regular reports on sector-specific and general threats, Cyble also publishes comprehensive monthly, semi-annual, and annual reports on the threat landscape that are available for free download. Cyble’s annual threat landscape report will be published in January in the Research Reports section – and will include predictions for 2025.

Cyble’s reports and blogs – along with thousands of daily bulletins sent to threat intelligence subscribers – offer critical, reasoned judgments and insights from seasoned threat researchers into the threats and vulnerabilities meriting priority attention, along with creative solutions to those challenges.

The post Must-Read Cyble Research Reports of 2024: Trends and Key Takeaways appeared first on Cyble.

Blog – Cyble – ​Read More

Overview

Cyble honeypot sensors detected dozens of vulnerabilities under attack in the threat intelligence leader’s most recent sensor intelligence report, including fresh attacks on an Ivanti vulnerability.

Threat actors also targeted vulnerabilities affecting PHP and the Ruby SAML library. Cyble’s Dec. 19 report noted that unpatched networks and IoT devices remain popular targets for hackers looking to breach networks and add to botnets.

The report also looked at Linux and Windows exploits, common brute-force attacks, and phishing campaigns.

Vulnerabilities Under Attack

Cyble detected fresh attacks on CVE-2024-7593, a critical authentication bypass vulnerability in the authentication algorithm implementation of Ivanti’s Virtual Traffic Manager (vTM), excluding versions 22.2R1 and 22.7R2. The 9.8-severity vulnerability can allow a remote, unauthenticated attacker to bypass admin panel authentication. It was added to CISA’s Known Exploited Vulnerabilities catalog in September, one of 11 Ivanti vulnerabilities CISA has added to the KEV catalog this year.

CVE-2024-4577 also remains under attack. The critical PHP vulnerability impacts CGI configurations and remains vulnerable in PHP versions 8.1.* before 8.1.29; 8.2.* before 8.2.20; and 8.3.* before 8.3.8. The 9.8-severity vulnerability enables attackers to execute arbitrary commands through specially crafted URL parameters.

CVE-2024-45409, a vulnerability in the Ruby SAML library designed for implementing the client side of SAML authorization, also remains a frequent target for hackers. In versions 1.12.2 and earlier, and 1.13.0 to 1.16.0, the library fails to verify the signature of SAML Responses properly. The flaw allows an unauthenticated attacker with access to a signed SAML document (issued by the IdP) to forge a SAML Response or Assertion with arbitrary contents, enabling unauthorized login as any user within the affected system. The issue has been resolved in versions 1.17.0 and 1.12.3.

Network and IoT Devices Under Attack

Network and IoT devices remain particularly popular with threat actors, as they can provide entry points into networks as well as additional nodes in a botnet. With many devices with vulnerabilities from 2023 and earlier still unpatched, Cyble noted that the following network vulnerabilities remain particularly popular with attackers:

CVE-2023-20198, a 10.0-severity vulnerability in the web UI feature of the Cisco IOS XE operating system, is being chained with CVE-2023-20273 to gain root privileges in vulnerable devices.

CVE-2023-4966 is a sensitive information disclosure vulnerability in Citrix NetScaler ADC and NetScaler Gateways when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.

CVE-2023-1389 is a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface of TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.

CVE-2023-46747 could allow undisclosed requests in F5 BIG-IP to bypass the configuration utility authentication, allowing an attacker with network access to the system through the management port and/or self-IP addresses to execute arbitrary system commands.

Vulnerabilities in real-time operating systems (RTOS) and embedded devices remain extremely popular with attackers, exposing operational technology (OT) networks with vulnerable devices to attack.

One last vulnerability hackers keep returning to is CVE-2023-47643, an unauthorized GraphQL Introspection vulnerability in the SuiteCRM Customer Relationship Management (CRM) system in versions before 8.4.2. The flaw allows an attacker to access the GraphQL schema without authentication, revealing all object types, arguments, functions, and sensitive fields such as UserHash. By understanding the exposed API attack surface, attackers can exploit this information to access sensitive data.

Linux systems remain continually under attack by CoinMiner, Mirai Botnet, and IRCBot malware, while hundreds of WannaCry ransomware samples continue to be detected each week in Windows 10, Windows Server 2016, and older systems vulnerable to CVE-2017-0147.

Remote Protocols Targeted in Brute-Force Attacks

Remote access protocols, particularly VNC (port 5900), remain popular targets of brute-force attacks. Examining the ports most targeted by the top five attacker countries, attacks originating from the United States targeted ports 5900 (42%), 22 (36%), 3389 (14%), 80 (5%), and 23 (3%). Attacks originating from Russia targeted ports 5900 (81%), 445 (7%), 22 (5%), 23 (3%), and 1433 (3%). Netherlands, Jordan, and China majorly targeted ports 5900, 22, and 445.

Security analysts are advised to add security system blocks for frequently attacked ports (such as 22, 3389, 443, 445, 5900, and 3306).

New Phishing Campaigns Detected

Cyble detected 277 new scam and phishing email addresses in the most recent weekly report. Here are six notable ones, including subject lines:

E-mail Subject	Scammers Email ID	Scam Type	Description
Are you interested in investment	Dave@oig.com	Investment Scam	Unrealistic investment offers to steal funds or data
UN Compensation Fund.	zagranica@usa.com	Claim scam	Fake compensation fund claim
COMPENSATION FUND OF 5.5 MILLION DOLLARS.	Info@uba.org	Claim scam	Fake compensation fund email
Funding projects up to USD 5 Billion	noreply@order.eventbrite.com	Investment Scam	Unrealistic investment offers to steal funds or data
HOTEL AND REAL ESTATE INVESTMENTS	richardowenr928@gmail.com	Investment Scam	Fake hotel and real estate investment scam
My Donation	test@cinematajrobi.ir	Donation Scam	Fake donation mail to steal money

Recommendations and Mitigations

Cyble researchers recommend the following security controls:

• Blocking target hashes, URLs, and email info on security systems (Cyble clients received a separate IoC list).
• Immediately patch all open vulnerabilities listed here and routinely monitor the top Suricata alerts in internal networks.
• Constantly check for Attackers’ ASNs and IPs.
• Block Brute Force attack IPs and the targeted ports listed.
• Immediately reset default usernames and passwords to mitigate brute-force attacks and enforce periodic changes.
• For servers, set up strong passwords that are difficult to guess.

Conclusion

With many active threats against both new and older vulnerabilities, organizations need to remain vigilant and responsive, patching wherever possible and applying mitigations where patching isn’t possible. The large number of brute-force attacks and phishing campaigns show that attackers remain active even heading into the holiday season.

To protect their digital assets, organizations should address known vulnerabilities and implement recommended security controls, such as blocking malicious IPs and securing network ports. A proactive and layered security approach will be key in protecting defenses against exploitation and data breaches.

The post Cyble Sensors Detect Attacks on Ivanti, PHP, SAML, Network Devices, and More appeared first on Cyble.

Blog – Cyble – ​Read More

The cybersecurity research team of ANY.RUN found and analyzed a bunch of emerging threats with the help of our mighty Interactive Sandbox and Threat Intelligence Lookup.

We’ve been sharing their findings via X and in our blog. Here is a summary on the most interesting insights from December 2024.

Phishing Campaigns targeting Microsoft’s Azure Blob Storage

Original post on X

Cyber criminals are abusing Microsoft’s cloud-based file storage solution by hosting phishing pages on the service, employing techniques like HTML smuggling.

The phishing pages are HTML documents that contain a block input element with the ID attribute “doom”. The pages include information about users’ software obtained via JScript (OS and browser), to make them more convincing.

Phishing pages on Azure Blob Storage typically have a short lifespan. Attackers may host pages with redirects to phishing sites. With minimal suspicious content, these pages can evade detection slightly longer.

See the analysis session in the ANY.RUN sandbox.

• Threat actors leverage the *.blob.core.windows[.]net subdomain to store documents.
• Company logos are extracted using email address parsing and loaded from the logo[.]clearbit[.]com service.
• To collect and store stolen data, an HTTP POST request is sent to nocodeform[.]io for collecting form submissions.

Use the following Threat Intelligence Lookup query to find threats targeting the set of requested domains:

And this search request to find links to HTML pages hosted on Azure Blob Storage.

Microsoft’s OneDrive also fell victim to HTML Blob Smuggling Campaign

The original post on X

As in the attack above, threat actors make victims believe they are logging into a legitimate platform.

Using ANYRUN’s MITM feature, we extracted base.js from the traffic and decoded it. The attack begins with a bait placed on OneDrive. After clicking the link, the user is redirected to the main page containing the HTML Blob Smuggling code. After entering their credentials, victims are redirected to a legitimate website.

Stolen credentials are sent via an HTTP POST request to the C2 server.

The website’s design, background, and icons are stored on IPFS, while lure images, mimicking real services, are hosted on imgur .com.

View the attack unfold in the wild: one, other, or yet another sandbox session.

Phishing links in Microsoft Dynamics 365 web forms

Original post on X

And again, a Microsoft service utilized for malicious activity. Phishers create forms with embedded links on *.microsoft.com subdomains. The links that users receive look legitimate, so people feel safe opening them.

With TI Lookup, we uncovered a link that tricked users into attempting to access a non-existent PDF file hosted on a Microsoft website.

Phishing URL: hxxps://customervoice.microsoft[.]com/Pages/ResponsePage.aspx?id=N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUNVIzNlI5MEhCNlBPRFMwMklUV0JZVTkxVS4u

Use this simple query for TI Lookup to find attacks employing this technique and view them unveiled in our sandbox.

Anatomy of a fresh LogoKit

Original post on X

LogoKit is a comprehensive set of phishing tools known for using services that offer logos and screenshots of target websites. Our team has researched the algorithm of such an attack.

Let’s look at the example run in our sandbox.

• The company’s logo is fetched from a legitimate logo storage service: hxxps://logo.clearbit[.]com/<Domain>.
• The background is retrieved via request to a website screenshot service, using the following template: hxxps://thum[.]io/get/width/<DPI>/https://<Domain>.

• The domain chain is led by a decoder-redirector: hxxps:// asiangrocers [.]store/fri/?haooauvpco=bWlubmllQGRpc25leS5jb20. It is a fake Asian food store website built on a #WordPress template, with a domain age of around four years. The template contains email addresses filled with typos.

The decoder-redirector shields the page from analysis and redirects the victim to the actual phishing page.

In our example, the real content of the phishing page and the associated scripts are hosted on the Cloudflare Pages platform. They are stored in the assets/ folder, which contains styles, images, and scripts

Three scripts with random 10-character names are designed to protect the page from analysis and send stolen data to the threat actors:

• assets/js/e0nt7h8uiw[.]js
• assets/js/vddq2ozyod[.]js
• assets/js/j3046eqymn[.]js

The stolen authentication data is sent to a remote Command and Control server controlled by the attackers via an HTTP POST request containing the following parameters: fox=&con=

Manufacturers, beware: an attack combining Lumma and Amadey is targeting you

The cybercriminals’ tactics of attacking the manufacturing industry are recently evolving from data encryption to snatching control over critical infrastructure and stealing sensitive information.

The consequences of such attacks can be severe, leading to theft of intellectual property, disruption of operations, financial losses, and compliance violations. Businesses need to take the threat most seriously, understand it and get prepared.

This December, we have analyzed a new attack aimed at industrial market players. The mechanics are based on Lumma Stealer and Amadey Bot. The former hunts for valuable information, the latter takes control over the infected systems. View analysis.

• It all starts with phishing emails with URLs leading users to download LNK files disguised as PDFs;
• The malicious LNK file, once activated, initiates PowerShell via an ssh.exe command. Following a chain of scripts, a CPL file is downloaded;
• PowerShell and Windows Management Instrumentation (WMI) commands are utilized to collect detailed information about the victim’s system.

For the details, read our blog post, view analysis session in our sandbox and dive deeper with TI Lookup. Use the search query with the name of the threat and the path to one of the malicious files used in the attack.

About ANY.RUN  

ANY.RUN helps more than 500,000 cybersecurity professionals worldwide. Our interactive sandbox simplifies malware analysis of threats that target both Windows and Linux systems. Our threat intelligence products, TI Lookup, YARA Search and Feeds, help you find IOCs or files to learn more about the threats and respond to incidents faster.  

With ANY.RUN you can: 

• Detect malware in seconds
• Interact with samples in real time
• Save time and money on sandbox setup and maintenance
• Record and study all aspects of malware behavior
• Collaborate with your team 
• Scale as you need

Get 14-day free trial of ANY.RUN’s Interactive Sandbox →

The post 5 Major Cyber Attacks in December 2024 appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – ​Read More

Ransomware attacks have evolved into one of the most significant threats to global cybersecurity. These attacks have shifted from mere opportunistic schemes to advanced operations targeting businesses, critical infrastructure, and even governments. The year 2024 saw ransomware actors innovating at an unprecedented pace, leveraging new technologies and tactics to inflict maximum damage.

With ransomware incidents causing an average cost of $4.54 million per breach—excluding ransom payments—it is imperative for organizations to stay informed and prepared.

This article delves into the top 10 ransomware trends observed in 2024 and provides predictions for what lies ahead in 2025.

1. Double and Triple Extortion Schemes

In 2024, ransomware actors moved beyond simple file encryption to adopt double and triple extortion tactics. These methods involve not only encrypting a victim’s data but also exfiltrating it and threatening to release it publicly unless a ransom is paid. Triple extortion adds another dimension: threatening to disrupt business operations or targeting customers and third parties associated with the victim.

• Example: A leading healthcare provider in the U.S. fell victim to a triple extortion scheme where attackers encrypted sensitive patient records, exfiltrated the data, and launched Distributed Denial of Service (DDoS) attacks until the ransom was paid. This resulted in financial losses and severe reputational damage.

Prediction for 2025: Expect these multi-layered extortion methods to become the norm as attackers seek greater leverage and higher payouts. Organizations will need to strengthen their data security measures and incident response plans to mitigate these risks.

2. Ransomware-as-a-Service (RaaS) Proliferation

The Ransomware-as-a-Service (RaaS) model gained significant traction in 2024, enabling even low-skilled cybercriminals to launch ransomware attacks. Under this model, ransomware developers provide affiliates with ready-to-use tools and infrastructure in exchange for a share of the profits.

• Example: Groups like LockBit, BlackCat, and Play have turned RaaS into a booming industry, offering technical support, user manuals, and even marketing strategies to affiliates.

Prediction for 2025: The RaaS ecosystem will expand further, with more criminal groups entering the market. This will likely result in a surge in ransomware incidents targeting small and medium-sized businesses (SMBs) that lack advanced cybersecurity defenses.

3. Data Exfiltration as a Standard Tactic

Stealing sensitive data before encrypting systems has become a standard tactic in ransomware operations. This not only increases the ransom demand but also amplifies the reputational and regulatory consequences for victims.

• Example: In 2024, a global financial institution faced a ransomware attack where attackers exfiltrated millions of customer records. The breach led to legal consequences and a loss of customer trust, despite the organization’s efforts to recover.

Prediction for 2025: With stricter data privacy regulations like GDPR and CCPA, data exfiltration attacks will pose an even greater risk. Organizations will need to implement stronger encryption and data loss prevention (DLP) solutions to counteract these threats.

4. Zero-Day Exploits and Advanced Phishing

Ransomware groups are increasingly using zero-day vulnerabilities and highly targeted phishing campaigns to gain initial access to victim networks.

• Example: In 2024, a large technology company was breached when employees fell for an advanced phishing email disguised as a legitimate communication from a trusted vendor. The attackers exploited a zero-day vulnerability to deploy ransomware, causing significant operational downtime.

Prediction for 2025: As more organizations adopt digital transformation initiatives, the attack surface for ransomware groups will expand. Expect more zero-day exploits and socially engineered phishing campaigns aimed at high-value targets.

5. Living Off the Land (LotL) Techniques

Ransomware actors are employing Living Off the Land (LotL) techniques to evade detection by using legitimate tools and processes already present in the victim’s network.

• Example: In a 2024 attack on a healthcare organization, attackers used PowerShell and Remote Desktop Protocol (RDP) to move laterally within the network without triggering traditional security alarms.

Prediction for 2025: LotL techniques will become more prevalent, making it essential for organizations to implement advanced endpoint detection and response (EDR) solutions and conduct regular audits of privileged accounts.

6. Critical Infrastructure as a Prime Target

Critical infrastructure sectors, including healthcare, energy, and government, have become top targets for ransomware groups. These sectors often lack strong cybersecurity defenses, making them vulnerable to attacks with far-reaching consequences.

• Example: In 2024, a North American energy provider suffered a ransomware attack that caused widespread power outages and operational disruptions.

Prediction for 2025: With geopolitical tensions on the rise, ransomware attacks on critical infrastructure are expected to increase. Governments and private sectors will need to collaborate on improving the resilience of these essential systems.

7. Industrial Ransomware Targeting Manufacturing

The manufacturing and industrial sectors have seen a rise in ransomware attacks, disrupting production lines and supply chains.

• Example: In 2024, a global automotive manufacturer was hit by ransomware that halted production for weeks, leading to millions in losses and delayed product deliveries.

Prediction for 2025: As industrial control systems (ICS) and IoT devices become more interconnected, ransomware targeting these environments will grow. Organizations must prioritize securing operational technology (OT) networks.

8. Decline in Average Ransom Payment but Higher Incident Costs

While the average ransom payment dropped from $850,000 to $569,000 in 2024, the overall cost of ransomware incidents has risen due to operational disruptions, data recovery expenses, and reputational damage.

• Example: A mid-sized retail company paid a lower ransom in 2024 but incurred over $3 million in total costs due to lost sales, customer churn, and recovery efforts.

Prediction for 2025: Organizations may see lower ransom demands, but the indirect costs of ransomware attacks will continue to climb. This highlights the importance of proactive defenses and comprehensive incident response plans.

9. Evolving Ransomware Variants

New ransomware variants with enhanced capabilities emerged in 2024, including Akira and BlackCat, which feature advanced encryption and stealth techniques.

• Example: Akira ransomware targeted a European bank, using multi-layered encryption that rendered recovery nearly impossible without paying the ransom.

Prediction for 2025: Ransomware variants will continue to evolve, focusing on bypassing traditional defenses and targeting cloud environments and hybrid work setups.

10. Increased International Collaboration and Crackdowns

Law enforcement agencies and cybersecurity organizations have intensified their efforts to combat ransomware through international collaboration. In 2024, several high-profile ransomware groups were dismantled, and stolen funds were recovered.

• Example: A joint operation by the FBI and Europol in 2024 disrupted a major ransomware operation, recovering $20 million in ransom payments.

Prediction for 2025: While these crackdowns are promising, ransomware groups will adapt and find new ways to evade law enforcement. Continued international collaboration will be critical to countering these threats.

Looking Ahead to 2025

As we move into 2025, the ransomware landscape will continue to evolve. Here are some key predictions:

1. AI-Powered Ransomware: Attackers will leverage artificial intelligence to automate ransomware campaigns and improve phishing success rates.
2. Focus on Cloud Environments: With more businesses migrating to the cloud, ransomware groups will target cloud-native applications and services.
3. Stricter Regulations: Governments will implement more stringent reporting and compliance requirements for ransomware incidents.
4. Cyber Insurance Challenges: The cost of cyber insurance will rise, with stricter conditions for coverage related to ransomware.
5. Post-Attack Recovery Services: Organizations will invest more in post-attack recovery services, such as takedown solutions and data restoration.

To Sum Up

The ransomware trends of 2024 highlight threat actors‘ adaptability and ingenuity. To stay ahead of these evolving threats, organizations must adopt a proactive approach, including strong cybersecurity measures, employee awareness programs, and collaborative efforts with industry peers and law enforcement.

By understanding the tactics and strategies employed by ransomware groups, businesses can better prepare for the challenges that lie ahead in 2025 and beyond.

Source:

https://cyble.com/knowledge-hub/ransomware-tactics-adopted-by-threat-actors-in-2024/

https://www.statista.com/topics/4136/ransomware/#topicOverview

Monthly Ransomware Threat Intelligence 2027.pdf

The post Top 10 Ransomware Trends Observed in 2024: A Look Ahead to 2025 appeared first on Cyble.

Blog – Cyble – ​Read More

The year 2024 has been a rollercoaster for cybersecurity professionals worldwide. From ransomware attacks paralyzing critical industries to insider threats causing massive data breaches, the challenges for Chief Information Security Officers (CISOs) and cybersecurity teams have been relentless. These cyberattacks and data breaches highlight the importance of adapting strategies and learning from past events to secure organizations better as cyber threats evolve. 

Here are the top five lessons for CISO and cybersecurity professionals should learn from as 2025 begins. 

Lessons from 2024 that CISOs Must Carry Forward 

1. Human Error Remains the Biggest Cyber Vulnerability 

A staggering 84% of CISOs in countries like Saudi Arabia, Canada, France, and South Korea identified human error as their organization’s greatest cybersecurity weakness in 2024. This vulnerability extends to phishing attacks, misconfigurations, poor credential management, and insider threats. 

Case in Point: The Star Health Insurance Breach 

In August 2024, India’s largest health insurer, Star Health, suffered a data breach exposing millions of customer medical reports and personal details. The threat actor “xenZen” accused the company’s CISO of insider collusion, sharing a screenshot alleging that credentials were leaked via email. 

This Star Health Insurance data breach highlights two key lessons: 

• Cybersecurity training needs to go beyond awareness: Employees, especially those handling sensitive data, must undergo regular, scenario-based training. 

• Strengthen insider threat detection: Advanced monitoring tools and strict access controls can help detect suspicious activities before they escalate into full-blown breaches. 

2. Multi-Factor Authentication (MFA) Is Non-Negotiable 

In 2024, weak or absent MFA emerged as a common denominator in several high-profile breaches. Attackers exploited credential weaknesses to gain access to sensitive systems, causing significant damage. 

Case in Point: The Snowflake Breach 

The U.S.-based cloud storage company Snowflake experienced a breachwhere compromised credentials—obtained through malware—were used to access sensitive customer data. The lack of MFA enforcement on demo accounts allowed hackers to compromise the data of high-profile clients like TicketMaster and LendingTree. 

Lesson Learned: 

• Implement MFA universally: Every account, internal or external, must have MFA enabled. A single weak link can jeopardize the entire ecosystem. 

• Enforce credential hygiene: Regularly rotate credentials, monitor for leaked credentials on the dark web, and implement strong password policies. 

3. Ransomware Is Evolving—So Must Your Defenses 

Ransomware attacks continued to dominate headlines in 2024, with 41% of CISOs worldwide naming it a top cybersecurity risk. These attacks increasingly targeted critical infrastructure and essential service providers, making their impact devastating. 

Case in Point: The CDK Global Ransomware Attack 

In June 2024, CDK Global, a software provider for car dealerships, was hit by a ransomware attack that disrupted operations for over 15,000 dealerships. Major companies like Asbury Automotive and Lithia Motors had to revert to manual processes, resulting in financial losses and customer dissatisfaction. 

Lesson Learned: 

• Strengthen endpoint protection: Implement advanced threat detection tools to identify and stop ransomware before it spreads. 

• Create vigorous incident response plans: Include regular backups, tabletop exercises, and quick recovery protocols to minimize downtime. 

4. The Supply Chain Is a Critical Weak Link

Cybercriminals increasingly exploited vulnerabilities in supply chains, targeting third-party vendors to gain access to larger organizations. 

Case in Point: The Dell Data Breach 

In 2024, Dell confirmed a data breach exposing 49 million customer purchase records. While financial data remained secure, the stolen information was sufficient to launch phishing and smishing attacks. 

Case in Point: The Ascension Health Cyberattack 

A massive cyberattack on Ascension Health disrupted clinical operations, forcing the nonprofit health system to disconnect from some business partners. The attack led to an additional operating loss of $1.8 billion for the fiscal year. 

Lesson Learned: 

• Conduct thorough vendor risk assessments: Before partnering with third-party vendors, evaluate their cybersecurity posture. 

• Mandate compliance with security standards: Require vendors to adopt strong security practices like SOC 2 compliance and regular penetration testing. 

5. Customer Trust Is Harder to Rebuild After a Breach

In 2024, cyberattacks had far-reaching consequences beyond financial losses. According to statistics, 47% of respondents indicated that attracting new customers became significantly harder after a data breach. 

Case in Point: Change Healthcare (CHC) Ransomware Attack 

In February 2024, Change Healthcare fell victim to a ransomware attack linked to the BlackCat group. With sensitive health data of over 110 million individuals exposed, the incident eroded trust among customers. Despite offering credit monitoring services, the reputational damage proved difficult to mitigate. 

Lesson Learned: 

• Be transparent and proactive: When breaches occur, communicate quickly, outline steps taken to mitigate the impact, and offer affected customers tangible support. 

• Invest in brand reputation management: Build a strong security narrative and a culture of trust through certifications, audits, and visible cybersecurity initiatives. 

Actionable Takeaways for CISOs and Cybersecurity Professionals 

As the threat landscape becomes increasingly complex, organizations must adopt a multi-faceted approach to cybersecurity. Incorporating advanced tools and platforms can significantly enhance CISO’s ability to address modern threats and safeguard their enterprise. 

Tools like Cyble Vision provide a comprehensive suite of capabilities that can empower organizations to identify, monitor, and mitigate threats across their digital footprint. For example: 

• Attack Surface Management: Proactively identify and mitigate vulnerabilities by gaining a complete view of your organization’s external attack surface. 

• Brand Intelligence: Protect against online brand abuse, including phishing and fraudulent domains, to safeguard customer trust and your organization’s reputation. 

• Dark Web Monitoring: Stay ahead of cybercriminals with continuous monitoring of dark web activities, uncovering leaked credentials, sensitive data, and emerging threats. 

• Cyber Threat Intelligence: Leverage AI-driven insights and continuous monitoring to detect and counteract evolving cyber threats in real time. 

• Takedown and Disruption Services: Address malicious campaigns effectively by removing fraudulent websites and disrupting attack operations. 

• Third-Party Risk Management: Identify and mitigate risks from vendors and external collaborators, ensuring security in your business partnerships. 

• Vulnerability Management: Use advanced scanning and remediation tools to address vulnerabilities before they are exploited. 

These capabilities, combined with features like digital forensics, incident response, and executive monitoring, enable CISOs to adopt a proactive, intelligence-led approach to managing cybersecurity challenges. Solutions like Cyble’s provide the visibility and tools needed to stay ahead of adversaries, reduce exposure, and protect critical assets. 

By integrating such advanced tools into their cybersecurity frameworks, CISOs can not only address existing risks but also build resilience against future threats, ensuring their organization’s digital security is always one step ahead. 

To Sum Up 

The lessons from 2024’s high-profile cyberattacks highlight the need for a shift from reactive to proactive cybersecurity strategies. With 38% of CISOs identifying malware as a top risk and 29% pointing to email fraud and DDoS attacks, it’s clear that the threat landscape continues to evolve at an alarming pace.  

However, as businesses navigate these challenges, the focus must remain on fortifying human and technological defenses, building cyber resilience, and fostering transparency in post-breach communication. 

As organizations worldwide grapple with the dual pressures of digital transformation and escalating cyber threats, the stakes have never been higher. Learning from the mistakes and successes of 2024 will empower CISOs and cybersecurity professionals to build stronger, more adaptive defenses—ensuring not just survival but success in the face of cyber adversity. 

The post Top 5 Lessons for CISOs and Cybersecurity Professionals from 2024 appeared first on Cyble.

Blog – Cyble – ​Read More