Verizon 2023 DBIR: Ransomware remains steady but complicated – TechTarget

Ransomware attacks plateaued last year, according to the 2023 Verizon Data Breach Investigations Report, though the telecom giant said the reality of the situation is a bit more complicated.

Verizon published Tuesday its 2023 DBIR, a report covering insights gained by Verizon’s security team from the 16,312 incidents and 5,199 confirmed data breaches it analyzed between Nov. 1, 2021, and Oct. 31, 2022. Key themes covered in the 2023 report included ransomware, social engineering attacks and Log4j exploitation.

The telecom giant said that while ransomware continues to be exceedingly popular among threat actors, the share of breaches involving ransomware held steady year-over-year at 24%. While a number of vendors and researchers have observed either a stagnation or even slight decline in various aspects of the ransomware ecosystem, the reality of the situation appears more complicated.

Chris Novak, managing director of cybersecurity consulting at Verizon Business and manager of the DBIR, characterized the story of ransomware this past year as one where threat actors retooled their tactics to adjust to the improving security postures of victims thanks to security technology getting better and organizations more effectively responding to and containing breaches.

“I think what we’re starting to find is, threat actor groups are recognizing that [defenders improving] impacts their ability to make money, so they’re retooling their technology,” he said. “They’re finding other ways to get their ransomware further into the environment and into more sensitive parts of the business in order to be able to better extract larger sums of ransom payments.”

Security vendors and government agencies alike have observed ransomware gangs shifting tactics to exclusively data theft and extortion to avoid detection. Meanwhile, threat actors are attacking sensitive institutions like hospitals in large numbers over the past year despite contradicting promises made by threat actors early on in the COVID pandemic. Novaksaid there was a possible connection between the two trends, noting a rise in breaches against healthcare organizations in this DBIR.

“I think part of it is that the ransomware threat actors are feeling the squeeze,” he said. “For the target industries that normally threat actors would go after, they’re finding that what they’re going after is getting smaller and smaller as those organizations are implementing better defenses. And now as a result, I think [the organizations] that were once off limits are now the softest parts to hit. They’re the easier targets to go after. And I hate to say it this way, but there’s leverage there that is hard to bargain with.”

The 2023 DBIR noted that the healthcare industry continues to be a popular target for ransomware gangs, though threat actor tactics have shifted somewhat. “While the number of ransomware incidents peaked in this industry in 2021, the last three years have seen a jump in data breaches (where the data is confirmed to have been stolen as well as the encryption triggered) caused by ransomware,” the report said.

Social engineering threats

Ninety-five percent of breaches in the year tracked by the DBIR were financially motivated. However, Novak said increasing geopolitical tensions, such as Russia’s invasion of Ukraine last year, have led to attacks where inflicting pain, distress or chaos in an environment is the goal.

A significant portion of the 2023 DBIR involved the “human element,” which Verizon defines as breaches caused by social engineering attacks, stolen credentials, error or misuse such as insider threats. Last year 74% of breaches involved the human element, down from 82% in 2021. While Novak considered it good news somewhat, he said it is still a large contributing factor to the breach landscape thanks to issues like poor password hygiene and password reuse.

Readers Also Like:  Estes reports cyberattack caused ongoing tech outage - Cybersecurity Dive

Social engineering attacks accounted for 17% of breaches and 10% of incidents overall. This is an increase over the previous year, which Verizon said was largely due to pretexting attacks — in which one party lies to another to gain access, such as impersonating an organization’s IT department or chief executive — doubling year over year.

Novak said social engineering is having a moment now in particular because organizations attempt to solve security issues by upgrading their products and services. But people remain “the squishy, soft spots of the organization.” Although solutions like user education and awareness training might help, he said, they can only do so much to correct bad habits like re-using passwords or creating weak, easy-to-remember ones for convenience.

“A lot of organizations, I would say, rely almost a little bit too heavily on the fact that they do web-based training once a year to tell people about security and what not to do,” Novak said. “Most organizations assume that once they do the training, people get it, and it sticks. But they don’t realize that when people go out into the outside world, they’re kind of being untrained every day. I think a lot of these interactions that we have day to day have untrained us faster than businesses can train us.”