Cyber security

Check Point® Software Technologies Ltd., a renowned cybersecurity solutions provider, has unveiled its Global Threat Index for October 2023, shedding light on a disturbing surge in cyber threats.

The report highlights the rise of the Remote Access Trojan (RAT) NJRat, which has climbed from sixth to second place, with a significant focus on targeting government agencies and organizations in the Middle East and Africa.

This escalation in cyber threats has been particularly severe in Africa, with Mauritius ranking 6th, Nigeria 11th, Morocco 15th, and Kenya 25th in terms of being targeted and attacked. South Africa follows, ranking 55th globally.

The report also emphasizes the expanding reach of the sophisticated RAT AgentTesla, propelled by a new and intricate mal-spam campaign using corrupted email attachments. The education sector remains a prime target, underscoring the ongoing vulnerability of this industry to cyber attacks.

According to Check Point Sales Engineer Rudi van Rooyen, “We cannot overlook the sophisticated tactics used by hackers to distribute malware, such as impersonating trusted brands or using malicious email attachments. As we enter the busy shopping season in November, it’s crucial to stay alert. Cybercriminals are taking advantage of the increased online shopping activity, and no region, including Africa, is immune to these threats.”

Check Point’s research also revealed that the “Zyxel ZyWALL Command Injection (CVE-2023-28771)” was the most exploited vulnerability, impacting 42% of organizations globally, followed by “Command Injection Over HTTP” and “Web Servers Malicious URL Directory Traversal.”

The report further outlines the top mobile malware, with Anubis remaining in first place, followed by AhMyth and Hiddad. Anubis is a banking Trojan malware designed for Android mobile phones, while AhMyth is a Remote Access Trojan (RAT) and Hiddad is an Android malware that repackages legitimate apps to display ads and gain access to key security details.

The ThreatCloud Map is powered by Check Point’s ThreatCloud intelligence, which provides real-time threat intelligence derived from hundreds of millions of sensors worldwide, over networks, endpoints, and mobiles.

The intelligence is enriched with AI-based engines and exclusive research data from Check Point Research, the intelligence and research arm of Check Point Software Technologies.

This comprehensive threat index provides valuable insights into the evolving cyber threat landscape and helps organizations and individuals stay informed and protected against emerging cybersecurity risks.

IBM Security’s X-Force Threat Intelligence Index report for 2023 revealed that despite improved detection and prevention methods, ransomware attacks have continued to increase.

The average time for attackers to complete a ransomware attack globally decreased from two months to four days.

The report identified backdoor deployment as the top attack action in the Middle East and Africa (MEA) region, accounting for 27% of cases, and ransomware and worms tied as the second most common attack type, each at 18%.

The finance and insurance sectors were the most targeted industries in the MEA region, accounting for 44% of incidents. The report concluded that companies must prioritize threat intelligence and strengthen their defenses.

The report features data collected by IBM globally in 2022 and can be downloaded from the IBM Security website.

A rapid rise in data breaches across numerous sectors has highlighted the intensity and ease with which cybercriminals can sabotage and hold for ransom valuable data, and quickly bring seemingly secure institutions to their knees.

What can organizations do to protect themselves?

Hosted by commercial law firm Cliffe Dekker Hofmeyr (CDH), a recent webinar entitled ‘Enemy at the Gates: The practicalities and difficulties of data breaches’ revealed the top cyber threats facing businesses to be business email compromise, hacking, and ransomware.

Preeta Bhagattjee: Director and Practice Head in CDH’s Technology, Media & Telecommunication practice, 

CEO at Digital Forensics Lab, Cyanre, Danny Myburgh noted there is also a rise in double extortions taking place in which hackers come in, steal data, and then encrypt it to extort companies to not only get their data back but then decrypt it as well.

It doesn’t stop there, Myburgh said triple extortions are even happening in which hackers not only steal and encrypt data but also mine it to identify and directly extort other data subjects.

“Typically, many of the vulnerabilities we find our left there by disgruntled employees. This is particularly true for disgruntled former IT administrators who know the systems in place. When you exit people, it is important to keep these vulnerabilities in mind,” said Myburgh.

In his presentation, Myburg identified two main modes of attack in which cybercriminals target organizations. The first he calls the shotgun approach. “This is where the attackers send out a million emails and if one of your employees is unlucky enough to click on it, unfortunately, they have fallen for the scam,” said Myburgh.

The second most common mode of attack is the most concerning. This is what Myburgh calls the targeted attack. “Hackers focus on one organization, perform in-depth background research, and then specifically target and attack an organization through accessible vulnerabilities. This is where employees tend to form the weak links, not the infrastructure.”

Unprotected mail accounts with no two-factor authentication, outdated software, poor password control, and a lack of sturdy firewall protocols are just a few of the common vulnerabilities that organizations can easily control.

While it may be easy to secure your data in theory, the reality is that hackers tend to be two steps ahead. What happens when a data breach happens to your business?

Director and Practice Head in CDH’s Technology, Media & Telecommunication practice, Preeta Bhagattjee said the first and most important first step is to be calm, cool, and collected. “When you are a victim of a data breach there are several important levers that would need to be considered quite quickly.”

While assessing the extent of the breach and the data that has been impacted, Bhagattjee says one would need to juggle many balls against which strategic, time-sensitive, and legally informed decisions need to be made.

How organizations can protect themselves from data bleach

When managing a data breach incident, Bhagattjee highlighted a few critical steps that should be taken. These include:

• Reporting obligations – depending on the type of breach and laws that apply to your business – there may be several reporting obligations (including under data privacy and cybercrime laws)
• Managing reputational risk – even though the payment of a ransom is not generally illegal, legal considerations along with reputational risk is to be understood if you are considering paying a ransom demand (i.e. known terrorist organizations)
• Managing system and technology risks – taking steps quickly to mitigate the technology breach or vulnerabilities but at the same time ensuring evidence is preserved for authorities
• Ensuring business continuity – consider the ramifications if you cannot continue to fulfill your contractual obligations to customers in light of the data breach
• Possible damages, costs, fines, and penalties –Claims for damages by the victims of the breach (ie. If the personal information of customers is published or they are defrauded by the cyber criminals), being subject to fines and penalties as well as the cost of systems changes and upgrades can arise due to the breach.
• Need an effective risk mitigation plan – understanding the learnings and preparing policies and procedures for the next attack are key

“You need to understand where data is coming into and leaving your organization, who manages it, and what rules apply to the gatekeeping of this data. Effective contracting with third-party data processors helps address the risk and frame the rules and procedures of avoiding a data breach but also handling a data breach incident if it occurs,” said Bhagattjee

As CDH has a presence in both South Africa and Kenya, the webinar delved into the ramifications of data breaches specific to each region. In South Africa, this meant an application of POPIA and how this data privacy regulation needs to be factored in. In Kenya, this discussion pertained to the country’s Data Protection Act.

Watch the full Enemy at the Gates: The practicalities and difficulties of data breaches webinar.

The Digital Services Act (DSA) is the second prong of EU antitrust Chief Margrethe Vestager’s strategy to rein in Alphabet (GOOGL.O) unit Google, Meta (FB.O) and other U.S tech giants.

This comes after an agreement that large online platforms will have to do more in terms of tackling illegal content.
Failure to which they risk hefty fines under the new internet rules agreed between European Union countries and EU lawmakers on Saturday.

Having won a backing from 27-country bloc as well as lawmakers about landmark rules called Digital Markets Act (DMA) that can enforce Google, Amazon, Apple, Meta and Microsoft into changing their core business practices in Europe.

Vestager said in a tweet that having a deal with DSA, the Digital Services Act will ensure that what’s illegal offline is also seen and dealt with as illegal online instead of a slogan this will be a reality.

The initiative gaining support from EU lawmaker Dita Charanzova who had urged for the need of such rules eight years earlier on saying that Google, Meta and other large online platforms will have to act better protect their users.
Adding that Europe has made it clear that they cannot act as independent digital islands.

Under the DSA, the companies face fines up to 6% of their global turnover for violating the rules while repeated breaches could see them banned from doing business in the EU.

Google said in a statement that as the law is finalized and implemented, the details do matter. Hence they are looking forward to working with the policy makers in achieving the remaining technical details right to ensuring the law works for everyone.

The numerous diverse online platforms and online search engines will be required to take specific measures during a crisis. The move having been triggered by Russia’s invasion of Ukraine and the related disinformation.

This new rules ban aim at advertising pointed at children or with the basis of sensitive data such as religion, gender, race and political opinions.

Since it’s with these dark patterns, which are tactics that mislead people into giving personal data to companies online, will also be prohibited.

The companies now face a yearly fee up to 0.05% of worldwide annual revenue to cover the costs of monitoring their compliance.

As the DSA is to be enforced in 2024, the companies might be forced to handing over data related to their algorithms to regulators and researchers.