Trellix, the cyber security company delivering the future of extended detection and response (XDR), today released The CyberThreat Report: November 2023 from its Advanced Research Center. Trellix observed indicators of collaboration between ransomware groups and nation-state-backed advanced persistent threat (APT) actors, adoption and usage of lesser-known programming languages for malware, and cyber criminals developing generative AI (GenAI) tools.
"As technology advances, so does cyber crime – and understanding the changing landscape is vital for CISOs and SecOps teams to stay ahead of threats," said John Fokker, Head of Threat Intelligence at Trellix Advanced Research Center. “Cyber criminals are becoming increasingly more agile, organised and politically aligned. It is imperative defenders refer to threat intelligence to strengthen their security posture with limited resources."
The Trellix Advanced Research Center’s latest CyberThreat Report includes:
- Malicious GenAI: Cyber criminals bypass protections to take advantage of commonly known tools and use GenAI to enhance phishing campaigns. The accelerating scale and speed of phishing attacks indicates malicious GenAI may already be in deployment today.
- Geopolitical threat activity: Nation-state threat activity spiked over 50% in the last six months due to conflict escalation in Russia and Ukraine, intensified cyber activity in Israel just before and during the conflict, and disruptive attacks on Taiwan heading into their 2024 elections.
- Ransomware developments: Global detections and industry-reported incidents, particularly in Q2, reflect unusual variations in ransomware families, as well as countries and industries targeted. The Trellix Advanced Research Center also observed a splintering of large ransomware groups, with the introduction of smaller groups and more attacks focused on data exfiltration.
- Underground collaboration: The last six months demonstrated an increase in threat actors actively collaborating on dark web forums. This spanned groups formally joining together (“The Five Families”), an escalation in selling/sharing of zero-day vulnerabilities, joint POC development efforts to accelerate exploitations, and more.
- Polyglot malware: Cyber, a polycrisis itself, is a threat multiplier – and the rise of polyglot malware further exacerbates this. New programming languages are becoming popular malware choices, with Golang seeing high usage for ransomware (32%), backdoors (26%) and Trojan horses (20%).
The cyber security landscape experiences upheaval regularly as geopolitical and economic developments create an increasingly complicated and uncertain world. New cyber actors emerge daily while new vulnerabilities, exploits and tactics are constantly discovered. The comprehensive analysis provided by the Trellix Advanced Research Center serves as a vital resource for today’s CISOs to understand and mitigate evolving cyber security risks in an interconnected world.
The CyberThreat Report: November 2023 includes proprietary data from Trellix’s sensor network, investigations into nation-state and cyber criminal activity by the Trellix Advanced Research Center, and open and closed-source intelligence. The report is based on telemetry related to detection of threats, when a file, URL, IP-address, suspicious e-mail, network behaviour, or other indicator is detected and reported by the Trellix XDR platform.
Additional resources
The CyberThreat Report: November 2023
Trellix Advanced Research Center
Trellix Advanced Research Center LinkedIn Newsletter
About the Trellix Advanced Research Center
The Trellix Advanced Research Center brings together an elite team of security professionals and researchers to produce insightful and actionable real-time intelligence to propel customer outcomes and the industry at large. Driven by the industry’s most comprehensive charter, our skilled researchers detect trends ahead of the market to empower our customers and partners to solve emerging threats. More at https://www.trellix.com/en-us/advanced-research-center.html.
Share