Large infrastructures and state-run facilities operate on large amount of data, and influential in their respective sector. This is why they are so alluring to cyber attackers.
According to a study by IBM’s X-Force Incident Response and Intelligence Services (IRIS) team, cyber attacks with destructions in mind have increased by 200% over the past six months alone.
Utilizing more sophisticated capabilities, the attacks were tailored specifically with intentions to wipe out data from those entities, shut down their critical systems, and/or prevent privilege access.
The team said that 50% of the malware attacks were targeting manufacturing facilities, including oil and gas, as well as education sectors, mostly in the U.S., Europe and parts of the Middle East.
While the use of malware was usually initiated by state-sponsored hacking groups to cripple geopolitical rivals, IBM researchers warned that since late 2018, the attacks are expanding beyond nation-states, saying that the attacks are becoming more popular among regular cybercriminal attackers.
The severity of the incidents can vary from one instance to another.
For example, those entities can lose access to tens of thousands of devices, forcing them to devote hundreds of hours to contain the attacks.
And if the malicious attack deployed was meant to wipe out data, the attack can literally render the entities inoperable and crippled. Without proper backup data and systems in hand, the damage can be irreversible.
In average, the cost of damage the affected organizations experienced go up to about $239 million, the researchers said.
The findings by IBM followed a previous report by F-Secure, which disclosed how cyber attackers inspired by North Korean hacking groups are using a wide array of targeted cyber attacks against the global finance industry with an aim to steal data and sabotage systems.
The common methods used to infiltrate the target's system, include phishing emails and password-guessing. But the researchers also observed supply chain attack scenarios where third parties with a connection to the target were compromised even before launching a malicious attack.
In a similar report, security firm Crowdstrike also cautioned how state-sponsored hacking groups are increasingly targeting mobile devices in an effort to conduct espionage, intelligence gathering and sabotage selected targets.
According to the report:
"We observe them taking care to covertly preserve access to privileged accounts or critical devices for the destructive phase of their attack, using them alongside legitimate remote command services within the targeted environment, such as PowerShell scripts, to move laterally through the victim’s network."
The researchers suggest companies to always test their response plan when under pressure, use threat intelligence to understand threats, engage in effective defense in depth, use multifactor authentication (MFA), have backup in place, an action plan when anything goes wrong, and create a baseline for internal network activity to monitor changes that could indicate lateral movement.
Some examples of destructive malware include, and not limited to: NotPetya and Stuxnet.
