The fear and anxiety of the current pandemic is the topping that makes cybercrime even more lucrative to automate.

Despite efforts by organizations to shore up their cyber defences, attackers have been continuing to innovate faster than ever before and are automating their attacks. Amid the global pandemic, cyber criminals are looking to gain from the crisis, and businesses are facing an uphill challenge to survive and at the same time maintain cyber-resilience.

This is the finding behind a global threat intelligence report by technology services provider NTT Ltd. In it, statistics for the study period indicate that over half (55%) of all attacks in 2019 were a combination of web-application and application-specific attacks, up from 32% the year before.

The report also indicated that 20% of attacks targeted content management software suites and more than 28% targeted technologies that support websites. For organizations that were relying more on their web presence during COVID-19 (such as customer portals, retail sites, and supported web applications) they risk exposing themselves through systems and applications that cybercriminals are already targeting heavily.

Matthew Gyde, President and CEO of the Security division, NTT Ltd., said: “The current global crisis has shown us that cybercriminals will always take advantage of any situation and organizations must be ready for anything. We are already seeing an increased number of ransomware attacks on healthcare organizations and we expect this to get worse before it gets better. Now more than ever, it’s critical to pay attention to the security that enables your business; making sure you are cyber-resilient and maximizing the effectiveness of secure-by-design initiatives.”

Technology tops most-attacked list

While attack volumes increased across all industries in the past year, technology and government sectors were the most attacked globally. Technology became the most attacked industry for the first time, accounting for 25% of all attacks (up from 17%).

Over half of attacks aimed at this sector were application-specific (31%) and DoS/DDoS (25%) attacks. There was also an increase in the weaponization of IoT attacks.

Government was in second position, driven largely by geo-political activity accounting for 16% of threat activity, and finance was third with 15% of all activity. Business and professional services (12%) and education (9%) completed the top five.

Mark Thomas, who leads NTT Ltd.’s Global Threat intelligence Center, commented: “The technology sector experienced a 70% increase in overall attack volume. Weaponization of IoT attacks also contributed to this rise and, while no single botnet dominated activity, we saw significant volumes of both Mirai and IoTroop activity. Attacks on government organizations nearly doubled, including big jumps in both reconnaissance activity and application-specific attacks, driven by threat actors taking advantage of the increase in online local and regional services delivered to citizens.”

Highlights of the study include:

• Websites posing as ‘official’ sources of COVID-19 information—but instead hosting exploit kits and/or malware—were created at an incredible rate, sometimes exceeding 2,000 new sites per day.
  
• The most common attack types accounted for 88% of all attacks: Application-specific (33%), web application (22%), reconnaissance (14%), DoS/DDoS (14%) and network manipulation attacks (5%).
  
• Attackers are leveraging AI and machine learning and investing in automation. Some 21% of malware detected was in the form of a vulnerability scanner, which supports the premise that automation is a key focus point of attackers.
  
• Old vulnerabilities remained an active target: attackers leveraged those that are several years old, but have not been patched by organizations, such as HeartBleed, which helped make OpenSSL the second most targeted software with 19% of attacks globally. A total of 258 new vulnerabilities were identified in Apache frameworks and software over the past two years, making Apache the third most targeted in 2019, accounting for over 15% of all attacks observed.
  
• DoS/DDoS attacks in APAC were higher than the global average, and about three times of the DoS/DDoS rate in EMEA, regularly appearing in the top five common attack types (Singapore #4 and Japan #5).
  
• Web-application and application-specific attacks dominated the region. They were the two most common attack types in Japan, and application-specific attacks were the most common attack types in Singapore and Hong Kong.

The report also calls 2019 the ‘year of enforcement’ as the number of Governance, Risk and Compliance (GRC) initiatives continued to grow, creating a more challenging global regulatory landscape.

Several acts and laws now influence how organizations handle data and privacy, including the General Data Protection Regulation (GDPR), which has set a high standard for the rest of the world, and The California Consumer Privacy Act (CCPA) which recently came into effect.

The report offers several recommendations to help navigate compliance complexity, including identifying acceptable risk levels, building cyber-resilience capabilities and implementing solutions that are secure-by-design into an organization’s goals.