ESET's Threat Report covers the period between December 2022 and May 2023, moving from a quarterly to a six-monthly release schedule
ESET, a global European leader in the cybersecurity market, has published the latest Threat Report, which summarizes the trends observed by detection systems from December 2022 to May 2023. In the first half of this year, new trends were observed that show the remarkable adaptability of cybercriminals and the search for new attack routes: exploiting vulnerabilities, obtaining unauthorized access, compromising sensitive information and implementing different actions for fraudulent purposes.
One of the reasons for the change in attack patterns is due to the stricter security policies introduced by Microsoft, particularly when it comes to opening macro-enabled files. ESET telemetry data found that the operators of the Emotet botnet have struggled to adapt to the reduction in attack surface implemented by Microsoft's new security policies, and this may indicate that the botnet is now being operated by another group of attackers. In the ransomware space, operators have increasingly continued to exploit previously disclosed source code to create new ransomware variants.
According to the report, in a new attempt to bypass Microsoft's security measures, attackers replaced Office macros with modified OneNote files in the first half of 2023, taking advantage of the ability to embed scripts and files directly into OneNote. In response, Microsoft changed the default setting, prompting cybercriminals to continue exploring alternative intrusion vectors, with the intensification of brute-force attacks against Microsoft SQL servers potentially representing one of the replacement approaches being tested.
“The source codes of ransomware such as Babyk, LockBit and Conti, allow less experienced groups to engage in ransomware activity, but at the same time allow us defenders to cover a wider range of variants with a more generic or well-known set of detections and rules,” says Roman Kováč, Chief Research Officer at ESET.
Although cryptocurrency-related threats have been steadily declining in ESET telemetry detections – and have not even been revived by the recent rise in the value of bitcoin – cryptocurrency-related cybercriminal activities continue to persist, with cryptomining and cryptostealing capabilities increasingly integrated into more versatile malware strains. This evolution follows a pattern seen in the past, such as when keylogger malware was initially identified as a separate threat, but eventually became a common feature across many malware families.
Looking at other threats that are more aimed at obtaining a significant financial return, ESET researchers observed in the first half of 2023 the return of so-called sextortion emails, capable of exploiting people's fear in relation to their activities online, and an alarming growth of deceptive Android apps that allow you to apply for loans, disguised as legitimate personal credit services that take advantage of vulnerable individuals with urgent financial needs.
