Learn about indicators and signals of cyber attacks, prevalence of phishing attacks, understanding targeted attacks in the help desk, correlation between infostealers and ransomware, trust in cyberattacks, discussion on attack indicators and the need for innovation.
Early warning signs of an attack include social engineering attacks, increased scanning of the network perimeter, and indicators of compromised authentication data.
Cyber attackers are utilizing alternative communication channels and exploiting human vulnerabilities to gain access to sensitive information.
Deep dives
Red Flags of a Cyber Attack
A recent report found that over 30% of North American ransomware victims had an info-stealer on their system prior to an attack, indicating that malicious actors are preparing for larger attacks. While phishing remains a significant indicator, other early warning signs include social engineering attacks targeting help desk and customer support representatives, increased scanning of the network perimeter, unusual user behavior such as accessing resources outside of typical hours, and indicators of compromised authentication data like increased failed login attempts. The commodification of the attack surface has made it easier for cybercriminals to enter the market and gain access to sophisticated tooling.
Expanding Attack Vectors
In addition to traditional email phishing, cyber attackers are utilizing other communication channels such as messaging apps, voice phishing, and social engineering attacks targeted at employees in customer-facing roles. These alternative methods rely on exploiting human vulnerabilities, trust, and emotional states to gain access to sensitive information. The simultaneous rise of machine-based authentication and identity types poses new challenges for security professionals, as attackers increasingly target machine, network, and data edges to introduce compromises beyond password compromises.
The Role of Info-Stealers
Info-stealers are a type of non-persistent malware that exfiltrate a range of data, including browser profiles, saved passwords, device information, and even user files. These malware are often sold as commodity tools on underground forums, making them easily accessible to less sophisticated attackers. The presence of info-stealers indicates a growing trend of ransomware attackers buying their way into attractive targets, serving as the entry point for subsequent attacks. Non-technical indicators of a potential attack include anomalous user behavior, escalated access privileges, increased scanning of the network perimeter, and higher than average access failures.
Challenges and Solutions
The evolving threat landscape requires organizations to go beyond focusing solely on phishing attacks and to implement measures that detect anomalies, identify unusual conversation patterns, and string together indicators of an ongoing attack. Threat intelligence, user behavior analytics, and anomaly detection play crucial roles in detecting and mitigating targeted attacks. However, understanding the attackers' methods and motivations is equally important to enhance defensive perimeters and mitigate vulnerabilities. While large enterprises have started addressing these challenges, it is crucial for small and medium-sized businesses, nonprofits, and personal websites to also prioritize cybersecurity measures and reduce opportunities for attacks.
All links and images for this episode can be found on CISO Series.
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Joining me is our sponsored guest, Trevor Hilligoss, senior director of security research, SpyCloud.
In this episode:
What are the things that raise red flags that you're about to experience an attack?
What signals set off your Spidey sense that things could go sideways?
What are the early warning signs an attack is underway?
Did you learn anything new?
Thanks to our podcast sponsor, SpyCloud
Get ahead of ransomware attacks by acting on a common precursor: infostealer malware. SpyCloud recaptures what’s stolen from infostealer-infected systems, and alerts your team to take action before compromised authentication data can be used by criminals to target your business. Get our latest research and check your malware exposure at spycloud.com/ciso.
Get the Snipd podcast app
Unlock the knowledge in podcasts with the podcast player of the future.
AI-powered podcast player
Listen to all your favourite podcasts with AI-powered features
Discover highlights
Listen to the best highlights from the podcasts you love and dive into the full episode
Save any moment
Hear something you like? Tap your headphones to save it with AI-generated key takeaways
Share & Export
Send highlights to Twitter, WhatsApp or export them to Notion, Readwise & more
AI-powered podcast player
Listen to all your favourite podcasts with AI-powered features
Discover highlights
Listen to the best highlights from the podcasts you love and dive into the full episode