Targeted attacks dominate mass attacks in 2019: Study

The percentage of targeted attacks in 2019 was much greater than that of mass attacks, and that the top target sectors were government, industry, healthcare, science and education, and finance, according to Positive Technologies’ study of the overall 2019 cybersecurity threat landscape.

According to the study, the number of unique cyberattacks increased by 19% in 2019, and the percentage of targeted attacks increased by 5 percentage points compared to 2018, now standing at 60%. Positive Technologies’ experts noted that the number of attacks increased every quarter in 2019. In Q1, 47% of attacks were targeted. At year-end, this figure had grown to 67%.

“The increase in targeted attacks is due to several reasons,” says Alexey Novikov, Director of PT Expert Security Center. “Every year we see new groups of attackers specialising in advanced persistent threats. During 2019, the Positive Technologies Expert Security Center (PT ESC) tracked APT attacks by 27 groups, ranging from well-known groups, such as Cobalt, Silence, and APT28, to relatively unknown newcomers. Companies are paying closer attention to cybersecurity, implementing and using special security tools (such as anti-APT solutions) to detect and prevent complex attacks. This makes it easier to detect malicious activity more accurately and significantly reduces dwell time. Because of this, information on individual incidents and particular tactics and tools used by different APT groups becomes public knowledge and can be used as intelligence to bolster countermeasures.”

Experts believe that companies should shift their attention from prevention of attacks in the perimeter, to timely detection and response inside the network, regularly checking any previous attacks. Considering the increase of targeted attacks, threat actors are constantly evolving their tactics, and malware is becoming more complex. Bearing this is mind, PT experts predict that in the next few years security will be centered around constant monitoring of security incidents, advanced network traffic analysis, and retrospective network events analysis.

Top target sectors were government, industrial, healthcare, science and education, and finance. Industrial companies accounted for 10% of attack targets, compared to 4% in 2018.

There were significant changes in attacker motivations for attacks on individuals: Positive Technologies’ 2019 cybersecurity threatscape report shows that data theft was the goal of more than half of all attacks, compared to 2018, which was only 30%. Information theft was the biggest driver for attacks, both on individuals (57%) and organizations (60%). In 2019, attackers were especially interested in personal data, credentials, and payment card numbers.

Analysis shows that ransomware is one of the biggest threats to companies worldwide. In 2019, ransomware accounted for 31% of all infections, and the average ransom paid in 2019 was hundreds of thousands of dollars. Towards the end of the year in 2019, Positive Technologies’ experts noticed a new trend. If the ransomware victim refused to pay the ransom, the malware operators started threatening to disclose the data they had copied before encrypting. At the end of 2019, such attacks were carried out by hackers operating Maze and Sodinokibi ransomware. It was a lucrative business for criminals who were motivated by financial gain. Positive Technologies expects a new wave of ransomware attacks in 2020, where hackers will hold victim data hostage and disclose information of those who refuse to pay.