Understanding the cybercrime ecosystem has never been more important than in 2024. Ransomware attacks and data breaches continue to proliferate, and it’s imperative that executives understand what’s driving the increase and more importantly how to prevent oneself from becoming a victim.
The nature of threat intelligence is changing
Cyber threat intelligence has historically focused on identifying major cybercrime groups and state actors (dubbed “Advanced Persistent Threats” or “APTs”). However the vast majority of breaches are not caused by these highly sophisticated actors.
Instead, organizations are breached by relatively low-sophistication actors that often operate on social media sites or dark web forums. For this reason, cyber threat intelligence has gotten a bad reputation for “low actionability.” If you concentrate all of your efforts on actors and tactics that only perpetrate a tiny proportion of attacks, it isn’t going to be all that useful to the average company.
It’s not that cyber threat intelligence can’t be useful. However, it has been focused on the wrong things. Take for example, the often underlooked trend that drives thousands of major breaches annually: breached identities compromised through infostealer malware. Steering more attention toward these less sophisticated actors will make a huge impact.
Breached identities and the value of intelligence
Right now, more than 70 million breached identities are being traded in the cybercrime ecosystem. This is largely due to infostealer malware, which steals all the credentials, session cookies, browser history, and even crypto wallet data from a single use.
Breached identities went from a minor nuisance in the 2010s, to one of the leading causes of data breaches in 2024. Yet many organizations are still not aware, and not properly responding to this threat. It is much more likely that an employee accidentally downloads infostealer malware onto their computer than an APT attempting a mass cyber attack on your organization.
With a single misclick or bad download, cybercriminals can sell incredibly sensitive data from a user for just a few dollars. That’s one of the reasons that the 2024 IBM-Xforce report states that “in this era, the focus has shifted to logging in rather than hacking in”.
Imagine you have an employee who falls victim to this malware, and dozens of credential pairs to third-party applications, internal systems, and networks, are leaked onto the dark web. Ransomware groups and threat actors will then purchase these credential sets and use them to stage an attack.
By our estimation, around 10% of breached identities contain credentials to corporate IT systems, amounting to millions of corporate credentials currently in the hands of cybercriminals. Back in 2023, Flare conducted a study that showed hundreds of thousands of breached identities with corporate access, including credentials to corporate VPNs, Single Sign-On environments, CRMs and accounting software have been sold by criminals in the past two years.
The future of continuous threat exposure management
Breached identities are just one threat vector that exposes thousands of companies to breaches. Legacy CTI providers are failing to provide adequate depth to their findings. That’s why the future of cybersecurity intelligence is using Continuous Threat Exposure Management (CTEM). CTEM products focus on two major priorities:
Identifying High-Risk Exposure: The first priority is to identify specific high-risk data exposure that leaves an organization at risk of suffering a major incident, ransomware attack, or data breach. Exposure could be anything from a breached identity to exposed data in a misconfigured S3 bucket.
Identifying Key Trends that Enable Strategic Decision Making: An effective CTEM solution should also present the latest trends in cyberattacks and data breaches in a way that is both actionable and enables effective strategic decision making.
By leveling up from cyber threat intelligence to CTEM, organizations can substantially reduce their risk of data breaches and ransomware attacks while focusing their security spend on intelligence that drives actionability.
We've featured the best encryption software.
This article was produced as part of TechRadarPro's Expert Insights channel where we feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/news/submit-your-story-to-techradar-pro
