Lockdown introduced new threat vectors for organisations in 2020, as cybercriminals redoubled their efforts to launch damaging cyber-attacks. Now that we are looking towards a post-lockdown future in 2021, it is worth exploring the cyber security landscape and assessing what steps we should take to protect ourselves from the pernicious threat of cyber-crime.
If there’s one thing you can say for cybercriminals, they rarely miss an opportunity. The coronavirus pandemic has offered cybercriminals a myriad of opportunities to exploit victims’ fears and uncertainties, sow seeds of false hope, and persistently cause disarray in the aid of compromising data and making money.
One year on from the first UK lockdown, we don’t expect this to change as we transition towards a post-lockdown world. The knock-on impact of lockdown is that many organisations are fighting to remain operational, and cybercriminals know this. They will continue to proactively target organisations that are struggling as a result of the coronavirus pandemic, as they recognise that budgets for IT and cyber security resources may well have been reduced – making them easier targets for phishing and ransomware attacks.
In this blog we’ll review the cyber security landscape as we see it in early-2021.
The Cyber Security Landscape in Early-2021
Let’s take a look at some of the key landmarks we’re seeing across the cyber security landscape in early-2021:
- Many of the coronavirus-related cyber-attacks we’ve seen to date have not progressed technically. It’s the methods of infiltration that have – those earlier steps in the malware kill chain that entice victims and gain initial footholds. PHaaS and RaaS (phishing as a service and ransomware as a service) have both seen significant uptake throughout the coronavirus pandemic, and we believe this ‘as a service’ way of working will continue to rise.
- When it comes to the methods cybercriminals employ, phishing emails – malicious emails containing links or documents laden with malware – continue to be a prominent threat. Cybercriminals design them to evade both technical and human defences, and organisations should expect phishing to remain one of the main threat vectors that hackers use to deliver both ransomware and business email compromise (BEC) attacks in 2021.
- Over the past year, a lot of organisations have realised the benefits of mobilising a remote workforce and transitioning to a more flexible, hybrid operational model. We expect to see a continued increase in the targeting of conferencing tools moving forward, both through continued phishing campaigns and exploits identified following more in-depth research in the area.
- Emotet is one of the greatest threats to corporate networks, as it is used as a beach-head into corporate networks for other malware, including ransomware. Emotet uses malicious Microsoft Office documents as the means to deploy malware; when the document is opened it instructs the user to ‘Enable Editing’ and ‘Enable Content’; this deploys Macros onto the computer which contain malware.
- As many of us continue to work remotely, criminal organisations are increasingly turning to attacks against exposed RDP services, SMB services and cloud-based environments such as Microsoft 365. These services help manage and control our servers and provide access to the applications and data we need to remain productive remotely, making them an attractive target for hackers looking to launch damaging cyber-attacks.
Protect Yourself and Your Organisation
Cybercriminals are persistent, resourceful and adaptable, and there is no single solution to protecting your organisation from the aforementioned attacks. In order to protect your data, you need to know how to best defend against phishing emails.
But how can you adapt? Well, point solutions are all well and good but ‘defence in depth’ can only be achieved by understanding your security posture, aligning it to your risk appetite, continually assessing it for suitability, and equipping your staff with the latest information on threats to create a phishing-savvy workforce.
Our advice to anyone reading this is to keep cyber security high on your agenda; doing so will minimise your exposure to data breach and enhance your ability to remain efficient and operational.
We recently published a threat report to update you on the latest phishing attacks. This threat report highlights the most prominent threats and methods cybercriminals use to gain access to your networks and deploy ransomware. By understanding these threats, you can prepare, stay aware and protect against them.
Subscribe to the newsletter today
A newly-discovered cyber-attack has reached headlines as it…