Check Point Research reveals botnets on the rise, software vendors hit hard by cyber attacks

Software vendors saw the largest year-on-year growth in 2021 at 146%, according to the 2022 Security Report from Check Point Research (CPR), the threat intelligence arm of the organisation.

The report highlights the education and research sector as the most attacked industry, marking a 75% increase to an average of 1605 weekly attacks, the return of Emotet, cracks in the ransomware ecosystem and vulnerabilities in cloud services.

Concerningly, botnets were the leading attack category worldwide, followed by infostealers and cryptominers, the research shows.

Cyberattacks against the top 16 industries increase by an average of 55% in 2021, and overall organisations experienced 50% more weekly cyber attacks than in 2020.

Education/research sectors saw 1,605 weekly attacks taking the lead (75% increase), government/military saw an average of 1,136 weekly attacks (47% increase), communications saw an average of 1,079 weekly attacks (51% increase), and software vendors experienced the largest year-on-year growth (146%).

Key highlights from the report are as follows.

Supply chain attacks: The infamous SolarWinds attack laid the foundations for a supply chain attack frenzy. 2021 saw numerous sophisticated attacks such as Codecov in April and Kaseya in July, concluding with the Log4j vulnerability that was exposed in December.

The striking impact achieved by this one vulnerability in an open source library demonstrates the immense inherent risk in software supply chains, the research finds.

Cyber attacks disrupting everyday life: 2021 saw an increase in attacks targeting critical infrastructure which led to huge disruption to individuals' day-to-day lives, and in some cases even threatened their sense of physical security.

Cloud services under attack: Cloud provider vulnerabilities became much more alarming in 2021 than they were previously.

The vulnerabilities exposed throughout the year have allowed attackers, for varying timeframes, to execute arbitrary code, escalate to root privileges, access mass amounts of private content and even cross between different environments.

Developments in the mobile landscape: Throughout the year, threat actors have increasingly used smishing (SMS phishing) for malware distribution and have invested substantial efforts in hacking social media accounts to obtain access to mobile devices.

The continued digitisation of the banking sector in 2021 led to the introduction of various apps designed to limit face-to-face interactions, and those in turn have led to the distribution of new threats.

Cracks in the ransomware ecosystem: Governments and law enforcement agencies changed their stance on organised ransomware groups in 2021, turning from preemptive and reactive measures to proactive offensive operations against the ransomware operators, their funds and supporting infrastructure.

The major shift happened following the Colonial Pipeline incident in May which made the Biden administration realise they had to step up efforts to combat this threat.

Return of Emotet: One of the most dangerous and infamous botnets in history, is back. Since Emotet's November return, CPR found the malware's activity to be at least 50% of the level seen in January 2021, shortly before its initial takedown.

This rising trend continued throughout December with several end-of-year campaigns, and is expected to continue well into 2022, at least until the next takedown attempt.

Check Point Software VP research Maya Horowitz says, "In a year that began with the fallout from one of the most devastating supply chain attacks in history, we've seen threat actors grow in confidence and sophistication.

"This culminated in the Log4j vulnerability exploit which, yet again, caught the security community off-guard and brought to the fore the sheer level of risk inherent in software supply chains.

"In the months between, we saw cloud services under attack, threat actors increasing their focus on mobile devices, the Colonial Pipeline held to ransom, and the resurgence of one of the most dangerous botnets in history."

She continues, "But it's not all doom and gloom. We also saw cracks in the ransomware ecosystem widen in 2021, as governments and law enforcement agencies around the world resolved to take a tougher stance on ransomware groups in particular.

"Instead of relying on reactive and remedial action, some shocking events woke governments up to the fact that they needed to take a more proactive approach to dealing with cyber risk.

"That same philosophy extends to businesses too, who can no longer afford to take a disjointed, siloed, reactionary approach to dealing with threats. They need 360-degree visibility, real-time threat intelligence, and a security infrastructure that can be mobilised in an effective, joined-up manner.

Check Point Software head of threat intelligence Lotem Finkelstein says, "The recent arrests made in Russia of the REvil ransomware gang is a unique event in the history of cyber as it is the first time that the US Administration has collaborated with the Russian authorities to track down and arrest members of a ransomware group.

"Coming about one year after the Emotet group was taken down there are some key differences and one worrying similarity.

"First, on this occasion, actual arrests of the ringleaders have been made and assets have been seized like high performance cars large amounts of cash and crypto currency.

"However, you cannot arrest code. It only takes one or two members or affiliates of the gang to escape with the key attack tools for REvil to re-merge at a later date, possibly in another country. We can only hope this is not the case.

"The main positive take from this situation is that any ransomware gang that thought Russia was a 'safe haven' for them to practice their malicious trade will have to think again.

"This comes on the back of Ukraine closing down similar ransomware gangs in that country. It's certainly not the end of ransomware, but every measure that governments can take, by sharing intelligence, to restrict such criminal activity is to be welcomed. "