Page 238 - Cyber Defense eMagazine Annual RSA Edition for 2024

Phishing & Social Engineering: Sophisticated methods to trick cyber victims into downloading
malicious attachments or clicking on links that lead to malware infections are also becoming common.
For instance: Phishing emails, made to look legitimate from trusted sources. Social engineering attacks
on the other hand, come in many forms, like phone calls or instant messages manipulating the victim into
giving up sensitive information or downloading malware.

Compromised Websites & Drive-bys: Adversaries exploit website code vulnerabilities to serve
malicious content. These "drive-by" techniques silently trigger malware downloads, automatically
downloading and installing malware onto a user’s system, often without their knowledge or consent.
Reports suggest that a new organization will fall victim to Ransomware 2.0 attack every 10 seconds by
the end of the decade.

Malvertising: Cybercriminals are increasingly exploiting online advertising as a source for ransomware
distribution. Malvertising campaigns often target high-traffic websites and use sophisticated techniques,
such as “Watering hole” attack, where hackers compromise a legitimate website and inject malicious
code into the displayed ads. Even SMBs, once considered low-value targets, now find themselves in the
crosshairs of these indiscriminate digital threats.

Malware Kits: Found on the dark web and often designed to be user friendly, these kits generally include
tools, scripts, and other components that are packaged together to create custom malware. The kits often
offer built-in obfuscation techniques to avoid detection by antivirus software such as firewalls and
intrusion detection systems.

Infected File & Application Downloads: An attacker may distribute an infected version of a popular
software or tool that appears legitimate, but when downloaded and installed, it executes the ransomware.
This method can include disguising the files or applications as necessary updates, security patches, or
even enticing software or media downloads. In some cases, attackers may also use file-sharing platforms
or peer-to-peer (P2P) networks to distribute infected files or applications.

Messaging & Social Media Impersonations: A common tactic often exploiting users’ trust and curiosity.
It can often look like a direct message from a contact or a fake account that looks legitimate. In other
cases, attackers disguise ransomware as harmless links or file attachments, such as a photo or a video,
coming from a known source. It can also be disguised as scalable vector graphics (SVG) that, when
opened, downloads a file that bypasses traditional extension filters.

Brute Force Through RDP: Keeping passwords such as “password123” or “admin123? Threat actors
try many password combinations until they discover the right one. Attackers often use this method to
target remote desktop protocol (RDP) endpoints, typically found on servers or workstations that are used
by employees to connect to a corporate network remotely.

As ransomware threats continue to evolve, so must the defenses against them. Sentinel, with its
advanced cybersecurity solutions, provides a robust line of defense against these sophisticated malicious
attacks.

238