2023 has been no stranger to cyber threats and both the rates and sophistication of attacks launched have only continued on their upward trajectories. Based on findings from a recent Cyber Threat Intelligence Index report, threats like ransomware, data breaches, and software vulnerabilities have all made major impacts on the landscape this year. As global enterprises have scaled up the amount of data they produce and store, threat actors have kept a watchful eye for new opportunities for attack.

In this post, learn about some of the most pressing cyber threats seen targeting the endpoint, identity, and cloud surfaces from the first three quarters of this year. By dissecting the causes and impacts of these notable attacks, enterprise and security leaders can better secure their data, systems, and networks against advanced threats down the line.

Endpoint-Based Attacks

Endpoint attacks have evolved into a critical concern, posing substantial threats to businesses across all industry verticals. As the amount of endpoints multiply and remote work opportunities continue to be the norm, the endpoint attack surface expands and leaves organizations vulnerable to a range of threats.

Attacks on endpoints exploit vulnerabilities within privileged computers, smartphones, and internet of things (IoT) devices. Major threats that loom over the endpoint attack surface include ransomware, phishing scams, zero-day exploits, fileless malware, and Denial-of-Service (DoS) attacks.

Ransomware Attacks

In the first three quarters of 2023, ransomware has targeted multiple critical infrastructure and major companies, including those listed below:

• San Francisco’s Bay Area Rapid Transit (Vice Society) – San Francisco’s BART was hit in January by a ransomware attack claimed by the Vice Society group. While no service disruption occurred, stolen data was posted online. BART confirms no impact on services or internal systems, but concerns from the incident have arisen due to potential backdoor access to critical systems.
• Reddit (BlackCat Ransomware) – ALPHV ransomware group, also known as BlackCat, claimed responsibility for a February cyberattack on Reddit. The attack, initiated through a successful phishing campaign, resulted in the theft of 80GB of data, including internal documents, source code, and employee and advertiser information. The group had announced its intent to leak the stolen data after failed attempts to extort $4.5 million from Reddit for its deletion.
• Dole Food Company – Dole Food Company confirmed a ransomware attack that occurred in February, which compromised an undisclosed number of employee records. While the impact was limited, production plants in North America were temporarily shut down due to the attack. The incident affected Dole’s workforce data, as reported in their annual filing with the SEC.
• United States Marshals Service (USMS) – Described as a major incident, the ransomware attack on the US Marshals Service, a federal law enforcement agency within the Department of Justice, compromised sensitive law enforcement data, including legal process returns, administrative data, and personally identifiable information (PII) of subjects associated with USMS investigations, third parties, and certain USMS employees.
• City of Oregon (Royal Ransomware) – In May, the City of Oregon encountered a ransomware attack when county data was encrypted. Election and 911 dispatch remained under control, but all other government operations were impacted. Restoring systems were calculated at the cost of millions for software reloads and network reconstruction. Claimed by Royal Ransomware, the attackers demanded a ransom for data access, with the specific amount not disclosed by county officials.
• Enzo Biochem – The New York-based biotech company suffered a ransomware attack in April compromising test data and personal information of approximately 2.5 million individuals. Names, test data, and 600,000 social security numbers were accessed. The attack on Enzo closely followed a separate attack on pharmacy giant, PharMerica, in May that saw the sensitive data of nearly 6 million people exposed.

So far, the FBI, CISA, and NSA, in partnership with other enforcement agencies, have issued the following joint cybersecurity advisories on the following ransomware in the past three quarters:

• Royal – Cybercriminals have targeted US and international organizations with Royal ransomware since September 2022. After infiltrating networks, they disable antivirus and exfiltrate data before deploying ransomware. Ransom instructions come after encryption via a .onion URL, demanding varied amounts from $1M to $11M in Bitcoin. Royal ransomware has been observed targeting critical sectors like manufacturing, communications, healthcare, and education.
• LockBit 3.0 – LockBit 3.0 (aka LockBit Black) operations follow a Ransomware-as-a-Service (RaaS) model and is a more evasive and modular continuation of its predecessors LockBit and LockBit 2.0. Affiliates that use LockBit 3.0 have been seen employing a variety of TTPs to attack a wide range of businesses in critical infrastructure sectors.
• BianLian – BianLian is a cybercriminal group conducting ransomware attacks on US and Australian critical infrastructure since June 2022. Known for ransomware development, deployment, and data extortion, they often exploit valid Remote Desktop Protocol (RDP) credentials, utilize open-source tools for reconnaissance, and exfiltrate data using FTP, Rclone, or Mega. In 2023, BianLian shifted from using a double-extortion model to exfiltration-based extortion, threatening to release data if ransom isn’t paid. They have targeted professional services and property development sectors in previous campaigns.
• Cl0p – Since emerging in February 2019, CL0P ransomware has evolved and now operates as a Ransomware-as-a-Service (RaaS), initial access broker (IAB) selling access to compromised networks, and a large botnet operator targeting the financial sector. Initially known for double extortion, they changed tactics in 2021 to focus on data exfiltration. Cl0p has compromised over 3,000 U.S. and 8,000 global organizations.
• QakBot – Also known as Qbot, Quackbot, Pinkslipbot, and TA750, Qakbot has caused numerous global malware infections since 2008. Initially a banking trojan, it evolved into a versatile botnet and malware variant used for reconnaissance, data exfiltration, lateral movement, and delivering ransomware. It targets various sectors, including financial and emergency services, commercial facilities, as well as the election infrastructure subsector, selling compromised device access to further affiliate threat actors’ goals.

3CX Supply Chain Attack

In a supply chain attack discovered in March dubbed “SmoothOperator”, actors associated with the North Korean regime compromised the infrastructure of the 3CX Private Automatic Branch Exchange (PABX) platform. The VoIP software development company is used by more than 600,000 globally and has over 12 million daily users including organizations across the automotive, food and beverage, hospitality, managed information technology service provider (MSP), and manufacturing industries.

The actors used this access to insert malicious code into the 3CX endpoint clients, which were downloaded as updates by victims using the software. The backdoored version applied stealthy steganography by encoding a payload stub in an .ico image file hosted on a public code repository hosted at github[.]com/IconStorages/images, which let the malware obtain the active C2 server address. Long-reaching software supply chain attacks like these demonstrate how threat actors work innovatively to exploit network access and distribute malware.

ESXi & Linux Ransomware

Ransomware groups such as AvosLocker, Black Basta, BlackMatter, Hello Kitty, LockBit, RansomEXX, REvil, and the now-defunct Hive have all continued to target VMware ESXi servers throughout 2023. Since 2021, organized ransomware groups have expanded targeting to include Linux systems thanks to the high likelihood of critical services or sensitive data. Disruption of Linux systems can lead to service outages, placing increased pressure on victims to pay a ransom.

These attacks often target the intersection of endpoint and cloud services, including on-premises Linux servers and hypervisors like VMWare ESXi. SentinelLabs’ research found that the availability of Babuk ransomware source code has made an outsized impact on the ESXi threat landscape. Many other Linux families are proliferating, including recent Linux additions by actors behind Abyss, Akira, Monti, and Trigona.

Identity-Based Attacks

Targeting the core of digital trust and authentication, identity-based attacks continue to rise in the cyber threat landscape. These attacks exploit weaknesses in user identities, credentials, and authentication processes and seek to gain unauthorized access to sensitive data and systems.

Enterprises around the world have exponentially grown the number of digital identities used in day-to-day operations, each one widening this attack surface. These identities are most vulnerable to threats such as phishing (and all of its variations), credential stuffing, identity theft, (fueled by social engineering), and attacks on single-sign-on (SSO) systems and multi-factor authentication (MFA) protocols.

Microsoft Exchange Online & Azure AD Vulnerability

This summer, details emerged on attacks against several US government agencies by an actor tracked as STORM-0558, a China-aligned espionage-motivated actor. The attacks abused several components to Microsoft permissions, including broad application scopes and a stolen signing key, which enabled the actors to mint session tokens to affected organizations’ Microsoft services. The original reports suggested only Exchange Online was impacted, though researchers found the flaw impacted other types of Azure Active Directory applications, including all applications that support individual (non-organization) account authentication.

BingBang

BingBang is an issue in Azure Active Directory (AD) application scopes where the default configuration may expose applications to undesired access. Researchers found that the default configuration for many Azure applications meant that any Azure AD user could access applications.

To remediate the issues outlined in BingBang, organizations using Azure AD authentication should verify what levels of access are delegated to applications, focusing first on sensitive and critical applications.

Cloud-Based Attacks

Cloud-based attacks continue to be a prominent and concerning trend, targeting vulnerabilities within cloud technologies and infrastructures. These attacks aim to compromise sensitive data housed by enterprise businesses, disrupt operations, or gain unauthorized access.

Cloud environments are vulnerable to threat actors working to exploit weak access controls to infiltrate cloud repositories. Distributed-Denial-of-Service (DDoS) attacks, capable of overwhelming cloud servers and causing widespread service disruptions, are also a major threat to modern clouds. Most notably in 2023, there has been a significant increase in cloud infostealers where financially motivated tools steal data from vulnerable or misconfigured cloud environments.

Cl0p Ransomware

In May 2023, the Cl0p (aka Clop) ransomware group made waves by exploiting a zero-day vulnerability in the MOVEit file transfer server application, which runs on Windows servers. The exploit chain delivers a Microsoft Internet Information Services (IIS) .aspx webshell to the server’s MOVEitTransferwwwroot directory, which steals files from the server as well as connected Azure Blob Storage. SentinelOne’s report provides queries that organizations can use to identify potential exploitation by the Cl0p group.

The attack demonstrated a significant shift where traditionally endpoint-focused ransomware actors wrote code specifically to target cloud storage services. The impact was massive, with more than 500 organizations and the data of 34 million individuals compromised, making it one of the biggest threat campaigns of 2023.

Cloud Infostealers

Throughout 2023, there has been a consistent rise in prevalence of cloud infostealers, which seek credentials from misconfigured or vulnerable cloud services. Some notable examples include:

• AlienFox – AlienFox is a comprehensive tool built on Androxgh0st code snippets and sold through Telegram channels. Attackers run the modular, Python-based toolset remotely against exposed cloud services. AlienFox primarily targets credentials that attackers can abuse to conduct spam attacks, API keys, and secrets from popular services including AWS SES and Microsoft Office 365. A comprehensive breakdown of targeted services can be found in SentinelLabs’ full report.
• Legion – An offshoot from the same code origin as AlienFox, Legion shares much of the same, spam-centric features. Like AlienFox, Legion is distributed to buyers who frequent Telegram channels.
• TeamTNT Doppelgänger – The infamous TeamTNT seemingly returned in 2023 with a cloud stealer that targets credentials from a variety of popular cloud and development services. While attribution remains difficult with publicly available tools like these, the actor behind recent campaigns has demonstrated active development and adaptation to new attack surfaces, such as Google Cloud and Azure service account credentials. These recent campaigns use dynamic DNS hosting provider AnonDns for command-and-control (C2). Most of the tools are Bash or Shell scripts, though the group occasionally leverages binaries, such as a Golang executable (SHA1: 2ed9517159b89af2518cf65a93f3377dea737138) that enables propagation. The recent campaigns suggest the actor may have different motives. While the original TeamTNT prolifically delivered cryptocurrency mining malware with a minor focus on credential harvesting, the newer campaigns conduct more credential harvesting and environment enumeration than cryptomining.

Conclusion | How SentinelOne Measures Up to 2023 Cyber Attacks

Instability within the geopolitical and economic landscape have all led to significant challenges in securing global enterprises this year. What’s clear from the attacks listed in this blog post is that transnational and organized cyber criminals continue to develop their threat operations to execute high-impact attacks by extorting ransoms, disrupting governments and critical services, and exposing sensitive data. Continuing to share threat intelligence on past and ongoing threats allows security and enterprise leaders to better understand where their gaps and weaknesses are so as to prepare for similar attacks in the future.

Facing these challenges, business leaders this year are much more aware of their organizations’ cyber risks than they were in 2022 and, most importantly, more willing to address them. Leaders are focused on minimizing business disruption and reputational damage and devoting more resources than before to bolstering day-to-day cyber defenses. This encompasses the strengthening of controls around third-party access, establishing cyber risk management and accountability, as well as investing in advanced cybersecurity solutions.

SentinelOne is trusted by enterprises in every industry vertical, providing the protection they need to stay ahead of modern threat actors. In one platform, SentinelOne’s Singularity XDR unites endpoint, identity, and cloud protection into an efficient cybersecurity solution. Request a demo or contact us to learn more about how Singularity leverages the power of AI to detect and respond to today’s threats.

The Good | Lapsus$ Teen Members Found Responsible for High-Profile Cyber Crime Spree

This week, a London jury found 18 year-old Arion Kurtaj of Oxford, UK to be responsible for a series of cyberattacks against major firms, including Uber, Nvidia, and Rockstar Games. Additional charges include computer intrusion, fraud, and the demand for millions of US dollars in ransom backed by the threat of leaking sensitive information.

Kurtaj holds several online aliases, including teapotuberhacker, White, and Breachbase and is estimated to have made over 300 BTC from various illicit activities. Much of these ill-gotten profits, however, were reportedly lost to rival hackers and gambling. Alongside Kurtaj, a second teenager has been convicted for their association with Lapsus$ and breaching several companies.

Described by the court as a loose and unorganized collective of young “digital bandits”, Lapsus$ is thought to have members operating within the UK and possibly Brazil. Over the years, the group has targeted multiple high-profile organizations such as Microsoft, Okta, Cisco, T-Mobile, and Samsung. Since their emergence in December of 2021, members have been observed attacking government, technology, telecom, media, retail, and healthcare sectors for both notoriety and financial gain.

According to reports, Kurtaj and the unnamed 17 year-old first met online and committed cyber trespassing, sneaking into cellphone network operator servers. This soon escalated to ransoms and the use of swiped data to break into several cryptocurrency wallets. Prosecutors have noted the groups’ juvenile desire to defy and taunt victims, often leaving offensive messages after infiltrating systems. Kurtaj, who is autistic and deemed not fit to stand trial, did not appear in court to give evidence. Jurors were asked to determine whether the teen committed the alleged acts rather than to determine if he did so with criminal intent. These cases have simultaneously highlighted the vulnerability of teenage hackers and the need to enhance cyber defenses across the web.

The Bad | macOS Malware “XLoader” Returns Disguised As Productivity App

A new variant of the macOS malware known as “XLoader” has been discovered, now masquerading as an office productivity app called “OfficeNote”. In findings published this week, SentinelOne found that this version of XLoader is hidden within an Apple disk image named OfficeNote.dmg and signed with the developer signature “MAIT JAKHU (54YDV8NU9C).” Initially identified in 2020, XLoader functions as an information stealer and keylogger, operating under the Malware-as-a-Service (MaaS) model and succeeding the infamous Formbook malware.

XLoader was first seen targeting macOS in 2021, when it was distributed by attackers as a Java program. The new XLoader variant uses the C and Objective C programming languages to avoid the limitations caused by the requirement for Java Runtime Environment, which isn’t installed by default on Mac devices. SentinelOne noted several instances of this artifact on VirusTotal throughout July 2023, suggesting a widespread campaign.

The malware pretends to be an office application named OfficeNote but in reality, installs a Launch Agent in the background for persistent execution. Once active, XLoader captures clipboard data and information stored in directories linked to popular web browsers that could be exploited or sold to other threat actors. To evade analysis, XLoader employs evasion techniques against both manual and automated analysis. It also incorporates sleep commands to delay execution in an attempt to avoid detection.

SentinelOne concluded that XLoader remains a threat to macOS users and businesses, emphasizing the need for continued vigilance against such cyber threats. Customers of SentinelOne are automatically protected from this new variant of XLoader.

The Ugly | US & UK Critical Infrastructure Targeted By Lazarus Group’s New RAT

DPRK-backed Lazarus Group has exploited a patched critical security vulnerability in Zoho ManageEngine ServiceDesk Plus with the purpose of distributing a remote access trojan (RAT) named QuiteRAT. The targets of these attacks include internet backbone infrastructure and healthcare organizations in Europe and the US, according to reports by security researchers this week. Additionally, in-depth analysis of the group’s attack infrastructure uncovered a new threat called CollectionRAT.

QuiteRAT, a successor to MagicRAT and TigerRAT, exhibits similar capabilities but with a significantly smaller file size. The malware is built on the Qt framework, which adds complexity to its code and makes analysis more challenging for cyber defenders. The attacks, observed in early 2023, involved exploiting CVE-2022-47966, a vulnerability that emerged just five days before the first attack in a proof-of-concept (PoC) to deploy QuiteRAT from a malicious URL. Unlike MagicRAT, QuiteRAT lacks a built-in persistence mechanism and requires the server to issue commands for ongoing activity on compromised hosts.

The Lazarus Group is also observed incorporating open-source tools and frameworks for initial access in their attacks as opposed to using them solely post-compromise. The reports indicate the use of the open-source DeimosC2 framework and CollectionRAT for various malicious activities, such as gathering metadata, executing commands, managing files, and delivering payloads.

Despite the well-documented nature of Lazarus’s tactics, researchers noted that the groups’ continued use of the same infrastructure shows the threat actor has confidence in the continued success of their operations.

The dynamics of cyber threats have taken on a new level of complexity, driven by the escalating interdependency among various types of threat actors. In a thriving cybercrime-as-a-service (CaaS) economy, attackers are sharing their malicious tradecraft through readily available kits and tools and collaborating efficiently by leveraging shared services conveniently accessible on the dark web.

For enterprises, growing levels of interdependence amongst cybercriminals poses new challenges on the cybersecurity front. As threat actors pool their resources and knowledge, the sophistication and scale of attacks has been seen rising exponentially. The sharing of malicious tools and services also shortens the time it takes for new threats to emerge.

In this post, we explore the complex and growing web of interconnection that links sophisticated nation-state actors, threat gangs, and all levels of cyber criminals together. Understanding the shape of today’s cyber threat landscape is an essential prerequisite for all modern cyber defenders.

How Attackers Share Knowledge & Malicious Tradecraft

In recent years, the availability of cybercrime services has become firmly established amongst various levels of cybercriminals, leading to significant specialization within criminal networks and fostering cooperation among illicit vendors.

Cybercrime-as-a-service (CaaS) models allow attackers to share technical knowledge and malicious tradecraft through dark markets. This ecosystem operates much like a legitimate business, where aspiring attackers can purchase or rent tools, techniques, and expertise to launch their own campaigns.

Illicit service providers can efficiently serve numerous criminal entities by providing obfuscation, IoT botnet rentals, phishing services, backdoor generators, and more. These offerings are frequently marketed or sold on private forums and the dark web.

Navigating the Dark Web | Breeding Grounds for A New Wave of Cybercrime

A fertile ground for modern cybercrime, the dark web serves as a hub where cybercriminals can sell and share expertise, tools, and stolen data. These illicit spaces have driven interdependency among cybercriminals and amplified the scale and complexity of cyber threats.

Most popularly powered by TOR and .onion addresses, other darknet services are out there that can support criminal enterprises, including I2P (the Invisible Internet Project) and Hyphanet. While such services also serve legitimate purposes for anonymous and private network connections, internet privacy and censorship resistance, there is no doubt that the cybercriminals have benefited hugely from their availability.

Monetizing Breaches | The Emergence of Initial Access Brokers

While dark markets facilitate the tools, code, and services needed to perform cyberattacks, Initial Access Brokers (IABs) sell unauthorized access to compromised systems, enabling buyers to initiate their attacks. Their emergence has introduced a layer of monetization to data breaches, which underscores the transformation of cyber threats into a vastly profitable commodity.

Initial Access Brokers also offer a marketplace for stolen credentials and software vulnerabilities, which empower a broader range of attackers with diverse expertise. With such ready access to potential targets, cybercriminals are able to exploit these gateways to rapidly launch new campaigns.

Outsourcing Expertise for Profit | The Role of Cyber Affiliates

The shift in how threat actors collaborate is also attributed to cyber affiliates; individuals or groups that leverage their skills to assist in cyber attacks in exchange for a share of the profits. This decentralized approach enables specialization within the criminal ecosystem, where different actors contribute their expertise to create a more diversified and potent threat ecosystem.

Affiliates serve as integral components within the ransomware-as-a-service (RaaS) framework. Affiliates leverage the specialized resources and tools provided by the RaaS platform, enabling them to launch sophisticated campaigns even without advanced technical skills.

In return for their services, affiliates share a portion of the ransom payments with the RaaS operators. This collaboration amplifies the reach and severity of ransomware attacks since affiliates operate autonomously under the RaaS umbrella, expanding the threat landscape and generating profits for both parties involved.

Behind the Scenes | The Enablers Behind Cybercriminals

Beneath the surface of the cybercrime landscape lies a network of enablers that fuel their malicious operations. Crypter developers, for example, create tools that attempt to disguise malware, in the hopes of evading detection by less-sophisticated security software.

Malware kits and droppers offer pre-packaged malicious code, further lowering the barrier to entry to cybercrime and attracting a new breed of would-be criminals with less technical knowledge.

Bulletproof hosting plays a pivotal role in interconnecting cybercriminals. This type of hosting service provides a safe haven for illegal online activities by offering infrastructure that is resistant to takedowns and law enforcement actions. Bulletproof hosting providers set up their infrastructure in jurisdictions that are known to have lenient or inadequate internet regulations in place, making it difficult for authorities to shut down or seize their servers. The hosts generally have minimal content monitoring or restrictions, allowing cybercriminals to host illegal content, malware distribution, phishing sites, and other malicious activities.

By providing a reliable and secure platform, bulletproof hosting providers attract a range of cybercriminals, including those involved in malware distribution, phishing campaigns, and other illicit operations. This fosters an environment where cybercriminals can collaborate, share resources, and even coordinate attacks, making their collective impact much larger than if they had operated independently.

VPNs are among the most common services used by malware operators and scammers. Criminal VPN providers work by hosting proxies that users can route their traffic through to conceal their IP address as well as the content of the traffic. These services are typically advertised specifically to attackers on the darkweb.

Anonymizing Transactions | The Role of Cryptocurrency In The Threat Arena

Behind the explosion of cybercrime in recent years is the ability of criminals to move money without oversight. Cryptocurrency like bitcoin has transformed how threat actors manage their ill-gotten gains and conduct various illegal activities. Given its decentralized nature, anonymity, and ease of use, cryptocurrency has become a unifying means of handling criminal proceeds across diverse criminal activity.

Crypto wallets securely store digital assets and enable anonymous transactions through unique addresses. Mixers, or tumblers, shuffle multiple transactions, ensuring that the origin of funds is difficult to trace. Threat actors also use crypto swappers to convert from one cryptocurrency to another, which adds an additional layer of complexity. These tools collectively help cybercriminals mask their financial activities, making the detection and tracking of illegal proceeds more challenging for authorities to pin down.

Conclusion

The increasing interdependence observed among cybercriminals reflects the intricate nature of the modern cybercrime landscape. It also demonstrates the urgency for organizations to establish end-to-end cybersecurity strategies that are capable of safeguarding various attack surfaces autonomously.

While disruption of the cybercrime ecosystem is primarily a task for collaborative law enforcement and government policy, security leaders can play their part by ensuring that their solutions provide deep visibility across all systems, detect and respond to threats in real-time, and can scale as needed as the organization grows.

SentinelOne is ready to help security leaders defend their organizations against every level of cyberattack. To learn how we can help you build a robust security posture, contact us today or book a demo.

In recent years, there has been a significant uptick in the frequency and sophistication of attacks on the financial and banking industry. The following statistics illustrate the current breadth and depth of cyber attacks by various types of threat actors on financial entities:

• Financial institutions were the second most impacted sector based on the number of reported data breaches last year. Institutions in the U.S., Argentina, Brazil, and China were most affected. As of December 2022, finance and insurance organizations globally experienced 566 breaches, leading to over 254 million leaked records.
• Ransomware attacks on financial services have increased from 55% in 2022 to 64% in 2023, which is nearly double the 34% reported in 2021. Only 1 in 10 attacks were stopped before encryption took place, making a total of 81% of organizations a victim of data encryption.
• Data breaches cost the finance sector the second highest costs amongst all others at $5.9 million.

This blog explores the rise in cyber attacks on the banking and financial industries, their far-reaching consequences, and what these high-target entities can do to protect against the evolving tactics of threat actors.

Understanding the Risks Faced by the Financial Sector

In their 2022 Cybersecurity and Financial System Resilience report, the Federal Reserve Board actively notes all potential risks and emerging threats that affect the state of the U.S. economy. At no surprise, cybersecurity concerns topped the list, calling out Ransomware-as-a-Service (RaaS) and sophisticated Distributed Denial of Service (DDoS) attacks as the biggest risks to financial institutions’ ability to operate and safeguard customer data.

• RaaS – RaaS is characterized by heightened sophistication, rapid proliferation, and difficulty of attribution. RaaS empowers threat actors to establish templates that could be considered “franchised” threats. Accomplished threat actors license their software to other malicious parties, typically in exchange for a portion of the ransom proceeds. This threat model provides less advanced threat actors with many more ways of disrupting businesses. Victims that decline ransom payment often find themselves with the burden of reconstructing their infrastructure in order to reinstate normal business operations.
• DDoS Attacks – In sophisticated DDoS attacks, the attacker aims to render a machine or network resource unavailable to legitimate users by overwhelming the target or its surrounding infrastructure with traffic. The United States’ financial services sector has long been a target of DDoS attacks, which has also affected associated external entities and other stakeholders.

An excerpt from the Federal Reserve Board’s report highlights this concern, amplified through the lens of current geopolitics:

Banks and financial institutions can face significant short and long-term financial damages when they experience a cyberattack. These damages can result from a variety of factors, including operational disruptions, reputational harm, legal and regulatory consequences, and increased cybersecurity investments.

Immediate & Ongoing Fees

A single, successful cyberattack can lead to immediate financial consequences that directly impact a company’s financial performance. Costs are associated with the severity of the attack and the extent of the data exposure, leading to both immediate and long-term repercussions.

• Ransom Payments – In the scenario of a ransomware attack, the average payout cost has surged to $1.6 million on average compared to the previous year’s average of over $272,000. 43% of surveyed companies in the same report confirmed paying the ransom.
• Forensic Analysis & Investigation Fees – Organizations often engage cybersecurity experts to identify the nature and scope of the breach, analyze the attack vectors, and trace the attacker’s activities.
• PR & Crisis Management Fees – After a breach, organizations may engage public relations and communication experts to manage the institution’s public image and respond to media inquiries. This also involves notifying affected customers, partners, and stakeholders about the breach, potential data exposure, and recommended actions.
• Legal Expenses – Small to medium-sized businesses with no in-house legal team may seek legal advice to navigate the legal implications of the breach, including potential liability, regulatory compliance, and contractual obligations.
• Customer Compensations & Cost of Remediation – Depending on the information compromised during the attack, organizations may offer credit monitoring and identity protection services to affected customers to mitigate potential identity theft. This can include assisting customers in resolving fraudulent transactions or unauthorized account access for a period after the breach.
• Increased Premiums – Post-attack, companies may be forced to pay higher premiums for their cyber insurance coverage.

Regulatory & Legal Consequences

Financial entities and banks are mandated to follow applicable compliance frameworks such as PCI-DSS. After a breach, they will be subject to paying fines imposed by regulatory authorities for non-compliance with data protection and cybersecurity regulations. Those that fall victim to a cyberattack face substantial regulatory and legal consequences. Regulatory bodies impose fines and penalties for failing to safeguard customer data, comply with industry-specific cybersecurity standards, and promptly report breaches. These financial repercussions can amount to millions of dollars, severely impacting an institution’s bottom line.

In terms of legal implications, affected parties including customers and partners may initiate lawsuits to claim damages resulting from data breaches. Legal defense costs, settlements, and potential reputational damage from such actions can lead to long-lasting financial strain.

Disruption to Business Operations & Reputational Damages

Cyber attacks disrupt services, delay transactions, and lock up day-to-day operations. The more critical the attack is on the systems, the greater the cost to operations. In the immediate aftermath of an attack, resources may need to be redirected towards remediation, taking away from core business activities. Other than direct financial losses, indirect costs while rebuilding systems and restoring data, some additional cybersecurity measures require significant investments, which can put a strain on budgets.

The value of customer trust can’t be measured and a tarnished reputation is one of the most costly consequences of a data breach. The ongoing cost of a data breach is largely reflected in the competitive landscape as the victim organizations see a decrease in their brand value and market share. For publicly traded firms, this cost is mirrored in stock price fluctuations.

As news of a data breach is reported, damage to the victim organization starts to go beyond dollars and cents. The perception of poor security measures can lead clients to doubt the organization’s ability to safeguard their sensitive information, potentially causing customer churn. From a stakeholder’s perspective, negative media coverage amplifies the impact, eroding the organization’s credibility. Extending beyond the immediate aftermath, breaches can massively influence customer decisions, partnership opportunities, and market sentiment.

Building Cyber Resilience In Big Banks & Financial Giants

To better defend the nation’s critical infrastructure from ongoing attacks, the U.S. government has implemented programs such CISA’s Shields Up!, the Office of the National Cyber Director (ONCD), and the Cyber Safety Review Board (CSRB), and most recently, the new U.S. Cyber Trust Mark.

At the enterprise-level, security leaders can use the following checklist to assess their organization’s cybersecurity posture as it stands and improve any identified gaps.

1. Response & Recovery | How fast can we regroup post-cyber attack?

Financial institutions can be susceptible to cyberattacks even with preventative controls in place. To build long-lasting resilience, security leaders are encouraged to design, maintain, and consistently review plans to ensure business continuity in the event that a threat actor succeeds. This includes:

• Well documented incident response plans (IRP), communication matrices, and post-attack workflows. Focus on system and operations recovery and a chain of command that includes all necessary leads needed to facilitate the response plan.
• Good relationships with federal and local law enforcement entities and any cybersecurity resources available for the specific industry.
• Contacts for cyber forensics and any post-incident recovery experts that can be engaged as needed.
• Implementing a regular schedule to conduct cyber recovery exercises, audits, and red team and penetration testing.
• Consider cyber insurance as a risk management strategy to identify, measure, and monitor ongoing cyber risk exposure.

2. Network & System Security | How protected are we from cyber intruders?

Many organizations adopt an “assume breach” mentality where defenders operate under the assumption that their systems have already been compromised. This is a proactive approach which acknowledges the ever-present risk of cyberattacks and focuses on detecting and mitigating intruders as quickly as possible. By assuming a breach has occurred, defenders strategically deploy continuous monitoring, anomaly detection, and threat hunting techniques to identify malicious activities early on. In essence, “assume breach” empowers defenders to stay one step ahead of adversaries in the dynamic landscape of cybersecurity. Building up the necessary network configurations and system hardening includes the following key aspects:

• Securing all network components to ensure that only approved ports, protocols, and services are allowed.
• Reviewing, adjusting, and disabling (if necessary) any default user accounts and settings before system use.
• Performing vulnerability scans to cover all network and hardware components, firmware, and operating systems.
• Adhering to a strict patch management schedule.
• Adding threat detection and prevention capabilities to email systems to combat common email attack vectors such as phishing, whaling, spoofing, etc.
• Segmenting critical network components and services, particularly any business-critical and/or highly sensitive elements of the environment.

3. Identity & Access Management | How do we secure against illegitimate users?

The increase in phishing attacks and the effectiveness of threat actors in infiltrating login credentials mean that financial institutions must implement the right controls for identity and access management. This includes authentication controls for customers, employees, and any third-party access to sensitive systems. To build up a strong set of identity and access management controls:

• Implement multi-factor authentication (MFA) policies, network segmentation, and role-based access control (RBAC). This significantly enhances security by adding an additional layer of authentication beyond just passwords and minimizes the risk of unauthorized access to critical systems and data.
• Use the Principle of Least Privilege (PoLP), where users should be only granted the minimum level of access required to perform their responsibilities. This principle reduces the rolling impact should an account become compromised.
• Set up means for continuous monitoring, regular account audits, and encryption protocols. Real-time monitoring of user activities and access patterns allow security teams to quickly detect and respond to potential signs of breach. Using strong encryption protocols for authentication ensures that sensitive information like passwords is transmitted securely.

Conclusion

As geopolitical and socio-economic sands continue to shift, the targeting of financial institutions and the banking sector by sophisticated and well-funded threat actors continues to be a top concern.

Threat actors continue to refine their techniques and our defense against these attacks needs to evolve in parallel. Enhancing cybersecurity measures, information sharing, and early threat detection are now pivotal to both safeguarding financial systems and mitigating geopolitical tensions.

To learn more about how SentinelOne can maximize visibility across full environments and automate a powerful response against complex threats, book a demo or contact us today.