Q2 2022: Quarterly Threat Landscape

Q2 2022: Quarterly Threat Landscape Report

Product Serial: S-2022-07-21a

TLP: GREEN

ZeroFox Intelligence is excited to announce the release of our Quarterly Threat Landscape for Q2 of 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full report here.

Executive Summary

ZeroFox Intelligence collected and analyzed developments around key cyber threats during Q2 2022, and several trends stood out at the conclusion of the analysis. Notably, with the ongoing conflict in Ukraine, well-regarded threat actors continue to exchange ideas on how to maneuver within the new economic and political constraints. Immediate concerns continue to center around the fate of cryptocurrency funds and potential strategies to exchange them for fiat currency that can be spent. In addition, social engineering campaigns remained a persistent threat to organizations across the threat landscape this quarter, with threat actors very likely to continue targeting desirable employees in job-related scams—especially those in leadership positions who have elevated access levels, potentially leading to financial harm or corporate exposure.

The threat from vulnerability exploitation continued on an upward trajectory, most likely representing a new normal for the exploit landscape. ZeroFox Intelligence anticipates that threat actors will continue to leverage high-profile vulnerabilities in widely-used software—such as the Follina, Confluence, and F5 BIG IP applications—long after the security patches were released. Moreover, after a fall in activity in Q1 2022, the threat from Initial Access Brokers showed signs of resurgence. Threat actors may be pushed increasingly to more private means to sell illicit access, making the identification of activity more difficult. Botnet and malware deployment remained high, including from infostealers and banking trojans. To that end, high saturation of Malware-as-a-Service offerings will very likely continue to sustain low barriers to entry for threat actors and drive down the price of acquiring highly-capable malware.

Despite a drop in the number of ransomware and digital extortion attacks in Q2 2022, the overall threat remained broadly consistent with the previous quarter—albeit with threat actors conducting more damaging attacks. The healthcare and retail industries in particular experienced a resurgence in targeting. ZeroFox Intelligence also observed that ransomware threat actors may be struggling to elicit payments from victims, driving changes to extortion tactics. This may ultimately lead these actors to resort to more extreme pressure tactics in an attempt to cause greater operational downtime and reputational damage, which may have legal ramifications.

Lastly, the ongoing war in Ukraine continued to be the primary driver of geopolitical risk across the quarter and heavily influenced the cyber threat landscape. As the conflict in Ukraine continues on, issues like European Union/North Atlantic Treaty Organization membership and new sanctions on Russia are likely to trigger a Russian state response, which often coincides with Russian-backed groups targeting sensitive infrastructure.

Key Findings

• Russian-speaking cybercriminals demonstrated increasing concern regarding the ability to turn cryptocurrency into fiat currency, with specific unease related to the perception that cryptocurrency may be the only way to transfer financial support to Russia.
• Social engineering remained one of the most frequently reported intrusion tactics in Q2, with notable increases in the use of LNK shortcut files and fake Windows 11 upgrades to deliver malware and employment-related scams.
• The threat from Common Vulnerabilities and Exposures and previously-unknown software vulnerabilities likely increased in Q2 2022. Sustained quarters of high vulnerability disclosures provide more routes for threat actors to attack and place increased pressure on patch management processes.
• The Initial Access Broker marketplace showed signs of resurgence in Q2 2022 despite activity levels remaining lower than in 2021, likely reflecting continued limitations in supply. Threat actors may be pushed increasingly to more private means to sell illicit access.
• Despite the widespread media attention and Russia-aligned entities starting to target nations and entities that vocally opposed the war in Ukraine with botnet attacks, the threat from botnets in Q2 2022 appears to have remained unchanged.
• Malware deployment remained highly prevalent in Q2 2022, and ZeroFox Intelligence expects that to continue.
• Despite a drop in identified incidents, the threat from ransomware and digital extortion remained largely consistent with previous quarters. Threat actors changing extortion tactics may indicate difficulty in eliciting payments from victims.