A large increase of activity has been seen from malicious threat actors. Many different vectors have been combined to facilitate targeted and widespread attacks. Considering the technical difficulty of these methods, these attackers are highly sophisticated and organizations should be especially vigilant about the attack surface of their company. rocketwise recommends having proper patching and password policies, as well as keeping users trained to be wary of malicious emails.
Sophisticated attack methods have seen a large increase of spear-phishing, ransomware, and exploitation of public facing applications. Groups have been seen impersonating financial institutions to compromise credentials and deploy RATs (remote access trojans) by email. Other groups have been seen exploiting public applications to gain access to internal networks, then deploying wipers disguised as ransomware. Essentially – they are encrypting and wiping victims’ data while asking for a ransom for data that is not recoverable.
This is especially noteworthy due to the various methods being combined to facilitate these attacks. Groups have purchased various domains to impersonate financial institutions and perform spear-phishing campaigns. Once a user downloads a malicious .exe from an email, threat actors can gain access to the internal network, compromising any confidential data, and performing attacks as they see fit. Other advanced actors have been seen utilizing VPNs, and then tunneling traffic through an organization’s RDP hosts to deploy ransomware.
Organizations must be extremely cautious when considering their attack surface. Threat actors will steal confidential data, credentials, and even perform wiper attacks disguised as ransomware. Extremely advanced threat actors may try to stay persistent on the internal network to gather as much information as they can, and then perform an attack if they deem it necessary. The SolarWinds attackers were within the SolarWinds systems for at least 9 months before initiating their attacks.
Many dealership software vendors require the use of VPN's in order to access their software. As previously announced this year, several of those VPN providers have found vulnerabilities within their VPN software. This puts your dealership at a much higher risk.
Considering the different attacks being deployed, organizations should perform the following:
For more in-depth information about the recommendations, please visit the following links:
If you have any questions, please contact us.