Ransomware and business email compromises (BEC) topped the list of the types of attacks on organizations in the past year, making up 70% of the total number, according to the 2022 Unit 42 Incident Response Report from Unit 42 by Palo Alto Networks, a cybersecurity consultancy within the company. The firm compiled its report findings based on approximately 600 incident responses completed by Unit 42 between May 2021 and April 2022.

Here’s a quick breakdown of key findings:

Unit 42 said that attackers may focus on certain industries such as finance and healthcare because they store, transmit, and process high volumes of monetizable sensitive information – or simply because they make widespread use of certain software with known vulnerabilities.

Insider Threats

It’s not always about the money, according to the report. Grudges matter, too. Insider threats made up just 5.4% of the incidents Unit 42 handled, “but they can be significant because they involve a malicious actor who knows exactly where to look to find sensitive data,” the report said. What’s more, 75% of insider threat cases involved a disgruntled ex-employee who left with company data, destroyed company data, or accessed company networks after their departure.

This could be exacerbated during a recession, as layoffs and frustrations rise. Researchers predict that declining economic conditions could push more people into cybercrime as a way to make ends meet.

"Right now, cybercrime is an easy business to get into because of its low cost and often high returns," said Wendi Whitmore, SVP and head of Unit 42 at Palo Alto Networks, in a statement. “As such, unskilled, novice threat actors can get started with access to tools like hacking-as-a-service becoming more popular and available on the dark web.”

Ransomware

Ransomware can target sensitive organizations, such as hospitals, and can put even more pressure on organizations with threats of releasing sensitive information if the ransom is not paid. Additionally, Unit 42 has been tracking at least 56 active “ransomware as a service” groups operating since 2020.

“RaaS is a business for criminals, by criminals, with agreements that set the terms for providing ransomware to affiliates often in exchange for monthly fees or a percentage of ransoms paid,” the report said. “RaaS makes carrying out attacks much easier, lowering the barrier to entry for would-be threat actors, and expanding the reach of ransomware.”

Unit 42 reported that ransomware demands have been as high as $30 million over the past year, and some clients have paid ransoms of over $8 million. Unit 42 noted that threat actors attempt to access financial information when they have unauthorized access to a victim organization and calculate ransom demands based on the perceived revenue of the organization being extorted.

What’s Ahead?

Unit 42 asked its incident responders to look ahead to the cyberthreats on the horizon and provide some predictions. Here are some of the predictions they shared:

The full Unit 42 report is available here.

What to Read Next:

CISO in the Age of Convergence: Protecting OT and IT Networks

Quick Study: Cyber Resiliency and Risk

The State of ITOps and SecOps: An Inside Look