NTT Global Threat Intelligence Report: Up to 300% increase in attacks globally from opportunistic targeting

NTT Ltd., the global technology services provider, has launched its 2021 Global Threat Intelligence Report (GTIR), which reveals how hackers are taking advantage of the global destabilisation by targeting essential industries and common vulnerabilities from the shift to remote working.

Manufacturing, healthcare and finance industries all saw an increase in attacks globally (300%, 200% and 53% respectively), with these top three sectors accounting for a combined total of 62% of all attacks in 2020, up 11% from 2019.  In the UK and Ireland, manufacturing was the most targeted industry, accounting for 80% of all attacks in 2020 - well above the global average of 22% - followed by the finance sector at 18%. 

As organisations race to offer more virtual, remote access through the use of client portals, application-specific and web-application attacks spiked, accounting for 90% of all attacks in the UK and Ireland. This number was 23% higher than the global average (67%) and the highest rate of combined web attacks of any country analysed. Manufacturing bore the brunt of these attacks in the UK and Ireland, with 93% of all hostile activity targeted at the industry being web-application or application specific attacks. 

The GTIR provides insights from NTT’s Cybersecurity Advisory that applies a maturity score of an industry’s security programme globally. A score of 1-2 shows comparitive immaturity in security controls, while 6 indicates a fully mature security operation, with organisations generally aspiring to reach 3-4. Concerningly, healthcare and manufacturing have relatively low global maturity scores of only 1.02 and 1.21, respectively. These have decreased from 2019’s global baseline of 1.12 and 1.32, while attack rates have significantly risen. Manufacturing has experienced a three-year decline in scores, most likely due to changes in the operating environment and the evolution of attacks. On the other hand, finance continued to demonstrate the highest maturity benchmark score for the third consecutive year, of 1.84, a 0.02 decrease on last year, however. 

Kazu Yozawa, CEO of NTT’s Security division, says: “Last year we predicted a surge in targeted, opportunistic attacks and unfortunately, this has proven all-too-true. While these industries have done their best to maintain essential services throughout disruptive times, the fall in security standards when companies need them most is alarming. As services continue to move online and become increasingly digital to account for the new normal, organisations must be extra vigilant in upholding and maintaining best practices in their security.”

Malware sees a metamorphosis: Crypto malware surges while Trojans become more common

While malware is becoming more commoditised in features and functionality, it also became more diverse over the last year with the growth of multi-function malware. Cryptominers have replaced spyware as the most common malware in the world, but the use of certain variants of malware against specific industries continues to evolve. Globally, worms appeared most frequently in the finance and manufacturing sectors. Healthcare was impacted by remote access trojans, while the technology industry was targetted by ransomware.  The global education sector was hit by cryptominers due to the popularisation of mining among students who exploit unprotected infrastructures.

The crypto-currency market is a prime example, with cryptominers accounting for a staggering 41% of all detected malware in 2020 globally. XMRig coinminer was the most common variant, representing nearly 82% of all global coinminer activity and 86% in the UK and Ireland specifically. 

Mark Thomas, who leads NTT’s Global Threat Intelligence Center comments: “On one hand you have threat actors taking advantage of a global disaster, and on the other, cybercriminals capitalising on unprecedented market booms. The common thread throughout both of these situations is unpredictability and risk. Changes in operating models or adoption of new technologies present opportunities for malicious actors and with a surging crypto-currency market popular among inexperienced students; attacks were bound to happen. Now, as we enter a more stable phase of the pandemic, organisations and individuals alike must prioritise cybersecurity hygiene across all industries, including the supply chain.”

Further 2021 GTIR highlights:

  • Globally, attacks against manufacturing increased from 7% last year to 22%; healthcare increased from 7% to 17%; and finance is up from 15% to 23%.
  • Organisations in multiple industries globally saw attacks related to the COVID-19 vaccine and associated supply chains.
  • COVID-19 cybercriminal opportunism intensified, with groups such as the Ozie Team, Agent Tesla and TA505, along with nation-state actors like Vicious Panda, Mustang Panda and
  • Cozy Bear very active in 2020.
  • Globally, the most commonly occurring forms of malware in 2020 were Miners: 41%; Trojans: 26%; Worms: 10%, Ransomware 6%.
  • Cryptominers dominated activity in Europe, the Middle East and Africa (EMEA) and the Americas but were relatively rare in Asia Pacific (APAC).  
  • Ongoing fallout following the Schrems II decision invalidated the EU-US Privacy Shield and placed additional obligations on organisations transferring personal data from the EU to third countries.
  • NTT’s research shows that 50% of organisations globally are prioritising securing their cloud services - making it the top cybersecurity focus over the next 18 months.

Regional breakdown

EMEA:

  • EMEA experienced 79% of all attacks as combined application-specific (42%) and web-application (37%) attacks. 
    • At 90% of all such attacks, the UK had the highest rate of combined web attacks of any country analysed.
  • Healthcare was the most attacked industry in EMEA.  
    • The combined attacks from web-application (62%) and application-specific (36%) attacks targeting healthcare in EMEA accounted for 98% of all hostile activity in this sector.  This is well above the global average of 67%.
  • XMRig accounted for nearly 99% of all miner activity in EMEA and for over 87% of all malware detections.
  • Trojans were the second most common form of malware within EMEA.
    • In the UK&I, six of the 10 most observed malware were some form of Trojan.

Methodology for the Global Threat Intelligence Report (GTIR)

The 2021 Global Threat Intelligence Report contains global attack data gathered from 1 January 2020 to 31 December 2020. The analysis is based on log, event, attack, incident, and vulnerability data from clients as well as from NTT's global honeypot network. The Report includes data from supported operating organisations including NTT’s Cybersecurity Advisory and WhiteHat Security, along with global primary research.

Comments (0)

Add a Comment

This thread has been closed from taking new comments.

Editorial: +44 (0)1892 536363
Publisher: +44 (0)208 440 0372
Subscribe FREE to the weekly E-newsletter