Cybercriminals adapt strategies to evade stronger defences

Cybercriminals are adapting their attack strategies to overcome increasingly robust security measures by targeting new vulnerabilities and employing low-tech methods, according to the latest findings from Arctic Wolf's annual Threat Report.

Ransomware groups are reportedly becoming more aggressive, partly due to internal competition and the improved resilience of their targets.

This includes employing tactics such as data theft to exert greater pressure on victims for ransom payments.

The report, issued by Arctic Wolf, gives a detailed analysis of current cyber threat tactics and provides actionable recommendations for organisations aiming to bolster their cybersecurity defences. These insights are based on data from Arctic Wolf's incident response engagements and the company's Aurora Platform.

Kerri Shafer-Page, Vice President of Incident Response at Arctic Wolf, noted a "critical shift in cybercriminal behaviour" towards data exfiltration. "Threat actors are no longer just locking up data with ransomware; they're stealing it first to maximise pressure on victims. The insights help organisations understand the risks they face today and shape the advanced detection and response strategies embedded within the Arctic Wolf Aurora Platform to keep our customers secure," she stated.

An alarming 96% of ransomware cases analysed in the report involved data theft, a tactic increasingly used to amplify extortion efforts.

The report also identifies three main cyberattack types accountable for the majority of incident response cases: ransomware at 44%, business email compromise at 27%, and intrusions at 24%.

There is a marked increase in business email compromise (BEC), especially in the financial and insurance sectors, where it accounted for 53% of cases. In this sector, BEC incidents even surpassed ransomware cases.

The report highlights the urgency of thorough patch management, as 76% of intrusion cases exploited just ten specific vulnerabilities.

These vulnerabilities were linked largely to remote access tools and externally facing services, none of which were zero-days.

Despite increased law enforcement efforts, ransomware commands a high financial burden, with median demand figures remaining at USD $600,000. This makes it a lucrative option for criminals.

Arctic Wolf's Incident Response Team has succeeded in reducing ransom demands by an average of 64%.

"Seventy percent of our clients avoided paying ransoms altogether," as reported by the company, demonstrating significant success in negotiating with cybercriminals.

The report gathers insights from Arctic Wolf's team, including incident responders, researchers, and data scientists, to provide a comprehensive view of the evolving cyber threat landscape. It is intended to help security, IT, and business leaders better anticipate threats and reinforce their digital defences.