Trellix’s John Fokker on the latest cybercriminal snapshot
Sep 26, 2024
auto_awesome
In a captivating discussion, John Fokker, Head of Threat Intelligence at Trellix and a leading expert on ransomware-as-a-service, shares insights on the evolving cybercrime landscape. AJ Vicens, a cybersecurity reporter, dives into the Snowflake breach, exploring how a notorious cybercriminal is facing increasing pressure from law enforcement. The conversation also highlights how AI is reshaping threat tactics, with criminals experimenting with new tools while law enforcement struggles to keep up. A must-listen for anyone interested in the future of cybersecurity!
The ransomware landscape has shifted dramatically as active strains increased significantly due to law enforcement pressure, forcing criminals to adapt.
Cybercriminals are experimenting with generative AI for tactics like crafting convincing phishing emails, though the overall threat level remains stable.
Deep dives
The Snowflake Cyberattack Insights
A significant cyberattack on Snowflake's customers revealed a sophisticated method of stealing and collating login credentials using InfoStealer malware. This breach impacted up to 165 customers, including major enterprises like AT&T and Ticketmaster, highlighting the scale and severity of the attack. Mandiant, the cybersecurity firm involved, identified a key threat actor linked to this incident who has reportedly earned between $2 million and $2.7 million from extortion related to these attacks. This case underscores the continuous threat posed by cybercriminals who, despite being monitored, still engage in extortion attempts against large organizations.
The Evolving Ransomware Landscape
Recent trends show a shift in the ransomware landscape, with a notable increase in the number of active ransomware strains, rising from approximately 50 to 200 within nine months. This evolution has been fueled by law enforcement's efforts to disrupt major groups like Hive and Lockbit, leading many affiliates to branch off and form smaller, independent operations. These smaller groups often utilize existing ransomware tools rather than develop sophisticated encryption methods, focusing more on data exfiltration and extortion tactics. This increasing fluidity in the ransomware ecosystem complicates detection and response strategies for cybersecurity professionals.
Generative AI in Cybercrime
Cybercriminals are beginning to explore generative AI technologies for enhancing their operations, albeit with a focus on specific applications rather than a complete overhaul of their tactics. While they utilize tools to craft more convincing phishing emails and obfuscate malware, the overall threat level has not significantly escalated. The comfort of using point solutions reflects a similar struggle in the security community to adopt AI effectively across operations. As both sides race to innovate, the lack of trust within the criminal supply chain remains a critical barrier to fully deploying advanced AI capabilities.
Data Extortion on the Rise
The conversation around ransomware is shifting towards data extortion, with actors increasingly opting to steal sensitive information and threaten public disclosure rather than deploying ransomware. This trend is driven by heightened regulatory scrutiny, which penalizes organizations for data breaches, making extortion a lucrative avenue for cybercriminals. The tactics used often echo traditional extortion methods, wherein victims are pressured into paying to prevent further harm. As a result, businesses must adapt their understanding and defenses against this evolving threat landscape to protect sensitive data more effectively.
CyberScoop Editor-in-Chief Greg Otto was out at Mandiant's mWISE conference last week, and talked with Trellix’s head of threat intelligence, John Fokker, about a host of different subjects. In the first portion of the interview, Greg and John discuss how the Ransomware-as-a-Service landscape has changed in the past year, and how threat actors have adjusted to the changes the industry has made in order to stop their schemes. In the second half, Greg and John talk about threat actors’ use of AI, which is in its experimentation phrase (like everyone else). In the reporter chat, Greg talks with AJ Vicens about research that shows how the walls are closing in on a suspect responsible for breaches tied to Snowflake.
LINK: https://cyberscoop.com/snowflake-hacker-judische-labscon-2024/
Get the Snipd podcast app
Unlock the knowledge in podcasts with the podcast player of the future.
AI-powered podcast player
Listen to all your favourite podcasts with AI-powered features
Discover highlights
Listen to the best highlights from the podcasts you love and dive into the full episode
Save any moment
Hear something you like? Tap your headphones to save it with AI-generated key takeaways
Share & Export
Send highlights to Twitter, WhatsApp or export them to Notion, Readwise & more
AI-powered podcast player
Listen to all your favourite podcasts with AI-powered features
Discover highlights
Listen to the best highlights from the podcasts you love and dive into the full episode