@BushidoToken Threat Intel

Introduction The aim of this blog is to highlight the 2024 global cybersecurity trends that defenders can study to prepare themselves for the threats of 2025. The Top 10 Cyber Threats of 2024 had several interesting themes, such as aggressive cyber espionage campaigns from Russia and China, new cases of state-sponsored cybercrime from Iran and North Korea, ground breaking ransomware attacks, and multiple disruption events that were notable. #1 The Snowflake Campaign This year, Snowflake was the center of a historic data breach campaign . Snowflake is a cloud-hosted service that allows companies to store huge datasets. In May, up to 165 customers had their databases accessed and stolen using valid login credentials. In June, the stolen data was offered on the English-speaking cybercrime community known as BreachForums, which was resurrected following a takedown by the FBI earlier in the year. The aftermath of the Snowflake campaign has been staggering. The publicly known impact ...

Introduction 2023 was packed with a multitude of significant events that caused many to rethink their entire security strategies, especially their vendors and their team size. Unfortunately, we saw thousands of layoffs in the technology sector, including cybersecurity teams. This is despite the unrelenting and omnipresent threat of an ever growing number of cyber adversaries. The Top 10 Cyber Threats of the year that I believe are worth focusing on in this blog revolve around several common themes, like the use of zero-day exploits, supply chain attacks, targeting identity providers, as well as intentionally disruptive campaigns. #1 CL0P mass exploitation campaigns Since 2020, a professional cybercrime syndicate known as CL0P shifted from targeted big game hunting ransomware campaigns to mass data-theft-extortion attacks, minus the deployment of ransomware. Around 27 May 2023, the CL0P group exploited a zero-day vulnerability in the MOVEit file transfer server, tracked as CVE-2...

After tracking the cybercrime threat landscape on a day-to-day basis for over four years now, it’s not that often anymore that something surprises me. But the latest trend of a suspected English-speaking big game hunting cybercriminal group, tracked under the moniker as Scattered Spider by CrowdStrike or 0ktapus by Group-IB, teaming up with a Russian-speaking ransomware group known as BlackCat (or ALPHV) has caught my attention. Background on Scattered Spider CrowdStrike introduced Scattered Spider in December 2022 and shared an update in January 2023 . These financially motivated English-speaking threat actors are known for their unique style of attacks, which usually all begin the same way, either via an SMS phishing message to harvest credentials or via an old school (yet still very effective) social engineering vishing call to get credentials or get the target to download malicious software and provide access. Other tricks Scattered Spider is known for includes multi-factor...