Navigating the Tides of Cybersecurity: Trends and Insights (May 16th - May 31th, 2024)

Introduction

In the latter part of May, there was a noticeable downturn in breach incidents compared to previous months, although 192 breaches were still recorded globally. This underscores the persistent hurdles organizations face in protecting their digital assets. Despite the decrease in breaches, it emphasizes the urgent need for robust cybersecurity measures to mitigate risks and bolster defenses against evolving threats.

These breaches expose digital assets, leaving organizations grappling with challenges such as securing against external attack surfaces, handling leaked credentials, combating info stealers, and addressing credit card breaches. Moreover, the presence of information on the darknet/dark web raises concerns, along with vulnerabilities from third-party sources and issues in vendor risk posture. Ongoing targeted phishing campaigns and brand impersonation issues further compound the challenges. Additionally, the lack of visibility into digital footprints and the absence of a definitive method to quantify cyber risk in near real-time add to the complexity of the situation.

Global Targets

The dark web analysis of breach data across various countries reveals a significant concentration of incidents in certain regions. The United States leads with 105 breaches, constituting 54.7% of the total 192 breaches. The United Kingdom follows with 9 breaches (4.7%), Canada with 8 breaches (4.2%), Italy with 7 breaches (3.6%), and both France and the "Other" category each with 6 breaches (3.1%). Spain reported 5 breaches (2.6%), while China, Germany, and India each accounted for 4 breaches (2.1%). Additionally, Belgium and Japan each reported 3 breaches (1.6%), and several countries, including Bangladesh, Brazil, Mexico, Poland, and Romania, had 2 breaches each (1.0%). Numerous other countries, such as Czechia, Ireland, Israel, Kuwait, Nepal, Netherlands, Pakistan, Portugal, Senegal, Singapore, Sudan, Sweden, Switzerland, UAE, Vietnam, The Bahamas, and Australia, each reported a single breach (0.5%). This data highlights the disproportionately high number of breaches in the United States, indicating a potential need for enhanced cybersecurity measures in this region.

Industry Dynamics

The dark web analysis of breach data across various industries reveals that the Manufacturing sector experienced the highest number of breaches, with 37 incidents, accounting for 19.3% of the total 192 breaches. This is followed by the Information Technology & Services industry with 16 breaches (8.3%), the Health Care sector with 13 breaches (6.8%), the Construction industry with 12 breaches (6.3%), and the Education sector with 10 breaches (5.2%). Other notable industries include Telecommunications with 8 breaches (4.2%), Financial Services and Government each with 6 breaches (3.1%), and the FMCG and Real Estate sectors each with 7 breaches (3.6%). The remaining breaches are distributed among various other industries such as Aviation & Aerospace, Environmental Services, and Business Services, each reporting between 1 to 4 breaches. This data underscores the need for enhanced cybersecurity measures, particularly in the Manufacturing, IT & Services, Health Care, Construction, and Education industries due to their higher incidence of breaches.

Employee Size

The dark web analysis of breach data across different employee counts reveals significant insights into organizational vulnerability. Organizations with 51 to 200 employees experienced the highest number of breaches, with 71 incidents, accounting for 31.6% of the total breaches. This is followed by organizations with 2 to 25 employees, which had 41 breaches, representing 18.3% of the total. Companies with 26 to 50 employees reported 23 breaches, making up 10.2% of the total. Those with 201 to 500 employees experienced 15 breaches, constituting 6.7% of the total, while organizations with 1,001 to 5,000 employees had 13 breaches, which is 5.8% of the total. Additionally, organizations with 501 to 1,000 employees reported 11 breaches (4.9%), those with 0 to 1 employee had 4 breaches (1.8%), and organizations with over 10,000 employees experienced 3 breaches, making up 1.3% of the total. Furthermore, companies with 5,001 to 10,000 employees and those classified as "Other" reported 1 breach and 10 breaches respectively, together accounting for 4.9% of the total breaches. This data highlights that smaller to mid-sized organizations, particularly those with 51 to 200 employees, are more susceptible to breaches compared to larger organizations.

Analysis on Attack Surface Management

We have identified 2,271 vulnerabilities, with 81 classified as critical. Among these, 22 currently have publicly available exploits. Notably, of the 81 critical vulnerabilities, 7 have publicly available exploits. It's worth noting that all these vulnerabilities carry an EPSS score ranging from 0.04% to 94.05%, indicating a high level of potential exploitation.

Foresiet research team has identified exploites available for Opportunistic Threat actor, to target easy attack. Listing a few: CVE-2024-32809, CVE-2024-31351, CVE-2024-22476, CVE-2024-5407, CVE-2023-3943, CVE-2023-3941, CVE-2023-3939, Etc.,

Threat Actors

It's evident from the dark web analysis that the threat landscape is diverse, with a total of 192 breaches attributed to various threat actor groups. Notably, Lockbit3 emerges as the most prolific threat actor group, responsible for approximately 15.63% of the total breaches with a count of 30. This highlights the significant impact and operational scale of Lockbit3 in cyberattacks. Following closely behind is the Akira group, comprising 15 breaches, accounting for around 7.81% of the total breaches. Additionally, Play and Ransomhub demonstrate considerable activity, with 17 and 15 breaches respectively, each constituting approximately 8.85% and 7.81% of the total breaches. These top five threat actor groups collectively contribute to around 48.91% of the overall breaches, showcasing their prominence in the cybersecurity landscape.

Among the other threat actor groups listed, Incransom, 8base, and Medusa also exhibit noteworthy activity, with 12, 11, and 11 breaches respectively. These groups each represent approximately 6.25%, 5.73%, and 5.73% of the total breaches, underlining their significance in cyber threat scenarios. Conversely, several groups have fewer instances of breaches, such as Apt73, Blackout, Donutleaks, Meow, and Qiulong, each responsible for only one breach, accounting for 0.52% of the total breaches. Despite their lower frequency, it's crucial to monitor these groups as they may pose emerging threats or indicate evolving tactics in the cybersecurity landscape. Overall, the data underscores the complex and dynamic nature of cyber threats, necessitating robust security measures and proactive defense strategies to mitigate risks effectively.

Top 5 Threat Actors

Dark web threats

The FBI has taken control of the BreachForums Telegram account amid investigations into cybercriminal activities, leading to the arrest of its owner, Baphomet, and the forum's shutdown. Despite this, numerous cyber threats and breaches continue to emerge, including ransomware attacks, data leaks, and website compromises. Major incidents involve the exposure of sensitive information from entities such as Toyota Makati, Poshmark, and various government and educational institutions. These events underscore the urgent and ongoing need for robust cybersecurity measures to protect personal and organizational data from persistent and evolving threats.

Conclusion

As the cybersecurity landscape continues to evolve, vigilance and proactive defense strategies are paramount. The prevalence of breaches across various industries, regions, and organizational sizes underscores the importance of prioritizing cybersecurity measures. By staying abreast of emerging threats and implementing robust defense mechanisms, organizations can mitigate risks and safeguard against potential cyber threats, ensuring the integrity and security of their data and systems.

About Foresiet!

Foresiet is the pioneering force in digital security solutions, offering the first integrated Digital Risk Protection SaaS platform. With 24x7x365 dark web monitoring and proactive threat intelligence, Foresiet safeguards against data breaches and intellectual property theft. Our robust suite includes brand protection, takedown services, and supply chain assessment, enhancing your organization's defense mechanisms. Attack surface management is a key component of our approach, ensuring comprehensive protection across all vulnerable points. Compliance is assured through adherence to ISO27001, NIST, GDPR, PCI, SOX, HIPAA, SAMA, CITC, and Third Party regulations. Additionally, our advanced antiphishing shield provides unparalleled protection against malicious emails. Trust Foresiet to empower your organization to navigate the digital landscape securely and confidently.