Cybercrime
,
Fraud Management & Cybercrime
Attackers Continue to Hit Edge Devices and Wield Info Stealers and Ransomware
As the year comes to a close, what’s notable over the past 12 months is how much hasn’t fundamentally changed on the cyberattack front.
See Also: Going Beyond the Copilot Pilot – A CISO’s Perspective
Nation-state and cybercrime hackers are exploiting edge devices at scale. Chinese nation-state and affiliated private hackers enjoy deep access to Western critical infrastructure through networks often poorly protected due to outdated or poorly configured equipment and inadequate visibility.
As Russia’s war against Ukraine continues, the Kremlin appears to be using cybercriminals as deniable proxies more than ever.
Ransomware groups’ collective profits appear to be dropping below their $1 billion high-water mark but they remain incredibly disruptive.
As 2026 looms, here’s what cyber defenders continue to face, and how it’s evolving.
Easy Access to Credentials
For hackers of all stripes, a ready supply of easily procured, useful tools abounds. Numerous breaches trace to information stealing malware, which grabs credentials from a system, or log. Automated “clouds of logs” make it easy for info stealer subscribers to monetize their attacks.
Criminals buy such credentials to gain easy initial access to a victim’s environment. The most recent Verizon Data Breach Investigations Report found that when the initial for a breach could be identified, in more than a fifth of all cases, it involved reusing stolen credentials, often facilitated by info stealers. This outpaced exploiting vulnerabilities, seen in 20% of incidents, and phishing attacks, seen in 16% of incidents.
As demonstrated by the leaked internal communications of ransomware group Black Basta, big users of these services include ransomware groups, said Milivoj Rajić, head of threat intelligence at cybersecurity firm DynaRisk.
Infostealer innovation is constant – some strains can now grab webcam images when the malware detects NSFW content, for use in sextortion attacks.
Supply-Chain Attacks Surge
The Clop ransomware group continued its habit of targeting vulnerabilities in widely used software again this year. The group this past summer launched a campaign targeting two different zero-day flaws in Oracle E-Business Suite, apparently amassing over 100 victims, including the likes of Broadcom, Canon and Oracle itself.
Clop, aka Cl0p, again stole data and held it for ransom. How many victims paid a ransom isn’t known, although the group’s repeated ability to pay for zero-days suggests it’s making a tidy profit.
Other cybercrime groups appear to have learned from Clop’s successes, including The Com cybercrime collective spinoff lately calling itself Scattered Lapsus$ Hunters. One repeat target of that group has been third-party software that connects to customer relationship management software platform Salesforce, allowing them to steal OAuth tokens and gain access to Salesforce instances and customer data.
The group has amassed over 1,000 victims by targeting third-party software providers including Salesloft and Gainsight, after which it set up a dedicated data-leak site, which the FBI promptly disrupted.
Youth Criminality on the Rise
The sheer scale of these and other attacks ascribed to Scattered Lapsus$ Hunters – including hits on major retailers and financial services firms – makes them tough to cohesively track. Such attacks are notable in part for the persistence displayed by these Western adolescents, including their ability to socially engineer help desks at major firms (see: Madman Theory Spurs Crazy Scattered Lapsus$ Hunters Playbook).
Law enforcement is racking up arrests of suspected members, lately including a juvenile male wanted in connection with attacks on MGM Resorts and Caesars Entertainment. The latter reportedly paid its 2023 attacker $15 million in cryptocurrency (see: Scattered Spider Sting: 2 English Teens Charged With Attacks).
Beyond the massive potential illicit revenue being earned by these teenagers, what’s also notable is the sheer brutality of many of these attacks, such as data breaches involving children’s nurseries including Kiddo and disrupting the British economy to the tune of $2.5 billion through a single attack against Jaguar Land Rover that shut down assembly lines and supply chains.
‘Evil as a Service’
Some attackers go even further, including the teenage members of 764, described by the U.S. Department of Justice as being a “nihilistic violent extremist group” that engages in all manner of criminality.
One Texas-based leader of the group, 19-year-old Alexis Aldair Chavez, on Friday pleaded guilty to racketeering and child pornography possession and distribution. He faces up to 60 years in prison.
Ian Thornton-Trump, CISO of Inversion6, labels such groups “evil as a service,” and told me they represent “a whole new shock-and-awe campaign of youth cyber criminality,” often comprised of individuals from deprived areas. These young offenders seem to thrive off of the “psychological dopamine release” they get from bragging to an army of social media followers, he said, and yet when based outside the United States may face little – if any – jail time. How to combat this phenomenon is an open question.
Scarce Breach Details
Greater information sharing by organizations is one potential strategy, not least because many groups – including Scattered Lapsus$ Hunters – will try to use the same tactics across a broad swath of potential victims in the same sector.
Unfortunately, as has been well documented by the U.S. Identity Theft Resource Center, while numerous breached organizations will notify victims – as required by state law – an increasing number don’t provide any details about what actually happened. Information sharing, rather than being on the increase, appears to be stalling – at least in some geographies. Britain’s draft Cyber Security and Resilience (Network and Information Systems) Bill, features stronger information-sharing provisions, backed by safeguards for the organizations sharing.
Cybersecurity Is National Security
Post-breach, some victims simply haven’t grasped the full scale of their intrusion. That’s been one takeaway from the Chinese cyberespionage group tracked as “Salt Typhoon” and its deep infiltration of Western telecommunications infrastructure.
As cybersecurity expert Ciaran Martin told me this past summer of the so-called Typhoon attacks tied to Beijing, “the major lesson is we need to be better at continuity of service, at being resilient to disruption and resilient to the loss of a major network” (see: Legacy Systems and Policies Expose West to Cyber Disruption).
The same holds true when analyzing opportunistic breaches, including ones that target U.S. and European operational technology environments. While self-proclaimed Russian hacktivists claim credit for these attacks, federal officials say many of these groups are either “state-sponsored” or “state-sanctioned.” They’re proxies for Moscow, including its GRU military intelligence agency.
One wrinkle is that the vast majority of Western critical infrastructure is privately owned. Who’s going to pay to lock it down? Stronger regulations are a potential answer; government funding is another. Whether there’s the political will to advance either strategy isn’t clear (see: US Telecoms Reject Regulation as Answer to Chinese Hacking).
Hype Hurts
Martin also offered a useful, bonus resilience lesson: avoid hype. Chinese hackers aren’t magicians. In many cases, they’re exploiting well-documented weaknesses in outdated Western networking gear.
Hype is a perennial problem, including warnings this past summer about a “colossal” collection of 16 billion credentials comprising “the largest data breach in history,” counting Google, Facebook and Apple as victims. The claims were bogus (see: Hype Alert: ‘The Largest Data Breach in History’ That Wasn’t).
The Basics Matter More Than Ever
Whenever detailing what’s wrong and who’s responsible, it’s important to highlight that many organizations and defenders continue to perform with excellence, as demonstrated in part by all the breaches that never happen.
Well-designed defenses help blunt many an attacker, or at least slow an intrusion. Enforcing least-privileged access to resources and multifactor authentication always helps, as do concrete security practices designed to block CEO fraud, tricking help desk ploys and other forms of forms of social engineering. Monitoring and logging matter too, more than ever, especially post-intrusion, so investigators can figure out what happened.
Time matters. Rapidly acting on internal security alerts or external warnings and calling in third-party digital forensic investigators were the top two ways organizations halted a ransomware attack, reported one study. Another found that artificial intelligence tools have been helping organizations more rapidly detect and contain breaches, which is important as some ransomware attacks go from intrusion to crypto-locking not in days, but hours.
None of this is news but the pace at which attacks unfold and defenders must respond, mitigate or triage seems to keep accelerating. Buckle up.