More than half of attacks last year leveraged fileless or “malware-free” techniques, as hackers increasingly turn to stolen credentials in their efforts to breach corporate networks. The telecommunications industry also saw increased attacks from threat actors such as those from China and North Korea, which targeted the sector for its intellectual property and competitive intelligence.
Malware-free tactics accounted for 51% of attacks in 2019, compared to 40% just the year before, though this figure was significantly driven by a sharp increase of such attacks targeting North America. Some 74% of attacks in the region were malware-free while such techniques accounted for 25% of attacks targeting Indo-Pacific, according to CrowdStrike’s Global Threat Report 2020.
The annual report’s assessment of the threat landscape is based on its analysis of data collected from more than 3 trillion events per week across 176 countries, consultations from its intelligence team that tracks 131 adversaries including nation-state and hacktivist actors as well as Falcon OverWatch threat hunters, and findings from its investigations of incident responses in 2019.
The increasing popularity of malware-free attacks underscored the need for organizations not to rely solely on antivirus tools, said CrowdStrike. The security vendor defined malware-free attacks as those in which files or file fragments are not written to disk. These could be attacks where codes executed from memory or where stolen credentials are tapped to enable remote logins. It added that malware-free attacks typically require various detection techniques to identify and intercept, such as behavioral detection and human threat hunting.
The 2020 threat report also saw more incidents of ransomware and ransom demands from cybercriminals who, increasingly, conducted data exfiltration, which enabled them to exploit sensitive data that was proprietary information or potentially embarrassing for victims.
In addition, nation-state adversaries last year targeted a range of industries, but were especially interested in the telecommunications sector, which saw increased attack frequency from nations such as China and North Korea, noted CrowdStrike. State actors from China, in particular, were keen to target the industry in a bid to steal intellectual property and competitive intelligence, said the US security vendor.
Furthermore, China’s state actors have continued to focus on supply chain compromises, “demonstrating the nation-state’s continued use of this tactic to identify and infect multiple victims”, CrowdStrike said. The vendor added that these hackers also targeted other US industries that are deemed critical to China’s strategic interests, including clean energy, healthcare, biotechnology, and pharmaceuticals. It said such attacks were likely to continue.
By Eileen Yu | March 3, 2020