www.helpnetsecurity.com Open in urlscan Pro
35.160.151.203  Public Scan

Form analysis
1 forms found in the DOM

POST

<form id="mc4wp-form-1" class="mc4wp-form mc4wp-form-244483 mc4wp-ajax" method="post" data-id="244483" data-name="Footer newsletter form">
  <div class="mc4wp-form-fields">
    <div class="hns-newsletter">
      <div class="hns-newsletter__top">
        <div class="container">
          <div class="hns-newsletter__wrapper">
            <div class="hns-newsletter__title">
              <i>
                        <svg class="hic">
                            <use xlink:href="#hic-plus"></use>
                        </svg>
                    </i>
              <span>Cybersecurity news</span>
            </div>
          </div>
        </div>
      </div>
      <div class="hns-newsletter__bottom">
        <div class="container">
          <div class="hns-newsletter__wrapper">
            <div class="hns-newsletter__body">
              <div class="row">
                <div class="col">
                  <div class="form-check form-control-lg">
                    <input class="form-check-input" type="checkbox" name="_mc4wp_lists[]" value="520ac2f639" id="mcs1">
                    <label class="form-check-label text-nowrap" for="mcs1">Daily Newsletter</label>
                  </div>
                </div>
                <div class="col">
                  <div class="form-check form-control-lg">
                    <input class="form-check-input" type="checkbox" name="_mc4wp_lists[]" value="d2d471aafa" id="mcs2">
                    <label class="form-check-label text-nowrap" for="mcs2">Weekly Newsletter</label>
                  </div>
                </div>
              </div>
            </div>
            <div class="form-check form-control-lg mb-3">
              <input class="form-check-input" type="checkbox" name="_mc4wp_lists[]" value="28abe5d9ef" id="mcs3">
              <label class="form-check-label" for="mcs3">(IN)SECURE - monthly newsletter with top articles</label>
            </div>
            <div class="input-group mb-3">
              <input type="email" name="email" id="email" class="form-control border-dark" placeholder="Please enter your e-mail address" aria-label="Please enter your e-mail address" aria-describedby="hns-newsletter-submit-btn" required="">
              <button class="btn btn-dark rounded-0" type="submit" id="hns-newsletter-submit-btn">Subscribe</button>
            </div>
            <div class="form-check">
              <input class="form-check-input" type="checkbox" name="AGREE_TO_TERMS" value="1" id="mcs4" required="">
              <label class="form-check-label" for="mcs4">
                <span>I have read and agree to the <a href="https://www.helpnetsecurity.com/newsletter/" target="_blank" rel="noopener" class="d-inline-block">terms &amp; conditions</a>
                </span>
              </label>
            </div>
          </div>
        </div>
      </div>
    </div>
  </div><label style="display: none !important;">Leave this field empty if you're human: <input type="text" name="_mc4wp_honeypot" value="" tabindex="-1" autocomplete="off"></label><input type="hidden" name="_mc4wp_timestamp"
    value="1706543766"><input type="hidden" name="_mc4wp_form_id" value="244483"><input type="hidden" name="_mc4wp_form_element_id" value="mc4wp-form-1">
  <div class="mc4wp-response"></div>
</form>

Text Content

 * News
 * Features
 * Expert analysis
 * Videos
 * Events
 * Whitepapers
 * Industry news
 * Product showcase
 * Newsletters

 * 
 * 
 * 


Please turn on your JavaScript for this page to function normally.
Help Net Security
January 29, 2024
Share


GLOBAL CRITICAL INFRASTRUCTURE FACES RELENTLESS CYBER ACTIVITY



In the last year, the world’s critical infrastructure – the medical, power,
communications, waste, manufacturing, and transportation equipment that connects
people and machines – has been under near-constant attack, according to
Forescout.



Despite the formidable challenges posed by the ongoing surge in cyber activity,
there is an optimistic path forward. Elisa Costante, VP of Research at Forescout
Research – Vedere Labs, highlights the potential for positive change, stating,
“While it’s true that current efforts have fallen short in fully harnessing
crucial technology to fortify critical assets and assess risks, there is an
opportunity for improvement.”

Exploits against software libraries are witnessing a decline due to the waning
popularity of Log4j exploits. This lull has given rise to a surge in exploits
targeting network infrastructure and Internet of Things (IoT) devices.

Among the IoT landscape, the spotlight falls on IP cameras, building automation
systems, and network-attached storage, emerging as the most sought-after targets
for malicious actors.


PERSISTENT ATTACKS ON OT

Only 35% of exploited vulnerabilities made an appearance in the Cybersecurity
and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities
(KEV) list. This divergence emphasizes the need for a proactive and
comprehensive approach to cybersecurity, transcending reliance on known
vulnerability databases.

Operational Technology (OT) finds itself under relentless assault, with five key
protocols bearing the brunt of persistent attacks. The primary targets include
protocols used in industrial automation and power sectors, such as Modbus,
subject to a staggering one-third of all attacks, closely followed by
Ethernet/IP, Step7, and DNP3, each accounting for approximately 18% of the
onslaught. IEC10X rounds out this list with 10% of attacks, leaving the
remaining 2% distributed among various protocols, with BACnet emerging as the
majority.

Building automation protocols, such as BACnet, experience less frequent scans.
However, the relative scarcity of scans belies an alarming trend—targeted
exploits against vulnerabilities in building automation devices are more
prevalent.

Persistence tactics mark a 50% surge from 3% in 2022, along with discovery
(roughly 25%) and execution (the other roughly 25%). While most observed
commands used by threat actors remain targeted at generic Linux systems, a
notable trend involves specific commands executed for network operating systems
found on widely used routers.

Malware families persist as formidable threats. The Agent Tesla Remote Access
Trojan (RAT) commands a significant 16% share of observed malicious activity.
Following closely are variants of the Mirai botnet, comprising 15%, and the
Redline info stealer, holding its ground at 10%.


HALF OF ALL THREAT GROUPS LINKED TO CHINA, RUSSIA, AND IRAN

Among command-and-control servers, Cobalt Strike emerges as the undisputed
leader, commanding a substantial 46% share, trailed by Metasploit at 16%, and
the emerging Sliver C2 at 13%. Most of these servers are in the United States,
constituting 40% of the global landscape, with China and Russia following at 10%
and 8%, respectively.

Threat actors have cast a digital net far and wide, impacting 163 countries. The
United States stands as the primary target, bearing the brunt with 168 malicious
actors setting their sights on the nation. Other countries include the United
Kingdom (88), Germany (77), India (72), and Japan (66).

The usual suspects boast high concentrations of threat actors: China (155),
Russia (88), and Iran (45), collectively representing nearly half of all
identified threat groups. The crosshairs of these malicious entities are
predominantly fixed on three key sectors: government, financial services, and
media and entertainment. As the primary pillars of societal infrastructure,
these industries are at the forefront of cyber warfare, emphasizing the need for
heightened security measures and collaborative efforts.

Costante continues, “The key lies in achieving comprehensive visibility,
ensuring real-time contextual awareness of every device, whether managed or
unmanaged. By doing so, large enterprises can transition from a reactive defense
posture to a more proactive approach, steering clear of the futile game of
security whack-a-mole. This shift towards enhanced visibility and proactive
defense strategies signals a brighter outlook for critical infrastructure.”





More about
 * critical infrastructure
 * cybercrime
 * cybersecurity
 * Forescout
 * report
 * survey

Share


FEATURED NEWS

 * Third-party risk management best practices and why they matter
 * Prioritizing cybercrime intelligence for effective decision-making in
   cybersecurity
 * What makes ransomware victims less likely to pay up?

Whitepaper: MFA misconceptions



SPONSORED

 * eBook: Defending the Infostealer Threat
 * Guide: SaaS Offboarding Checklist
 * eBook: Keeping Active Directory out of hackers’ cross-hairs




DON'T MISS

 * Third-party risk management best practices and why they matter
 * Prioritizing cybercrime intelligence for effective decision-making in
   cybersecurity
 * What makes ransomware victims less likely to pay up?
 * Emerging trends and strategies in digital forensics
 * Russian hackers breached Microsoft, HPE corporate maliboxes




Cybersecurity news
Daily Newsletter
Weekly Newsletter
(IN)SECURE - monthly newsletter with top articles
Subscribe
I have read and agree to the terms & conditions
Leave this field empty if you're human:

© Copyright 1998-2024 by Help Net Security
Read our privacy policy | About us | Advertise
Follow us
×