2022 Threat Intelligence Forecast

2022 Threat Intelligence Forecast

In this assessment, ZeroFox Intelligence reflects on security incidents from 2021 and makes predictions about what may come in 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full forecast here.

Introduction

ZeroFox Intelligence strives every day to produce complete, accurate, relevant, and timely intelligence reports our customers need to reduce risk and uncertainty against a constantly evolving threat landscape. This paper reflects the collective insights of the experts dedicated to that mission.

Information available as of January 20, 2022, was used in the preparation of this forecast.

We have gone further than telling you what we think will happen. We also offer recommendations to counter the threats described in the latter part of this forecast.

Please take our four question survey after reading this forecast. Your feedback is critical to ensuring ZeroFox Intelligence is delivering insights you need to gain a decision advantage over the threat landscape.

Executive Summary

Threat actors around the world made 2021 an extremely stressful year for security teams—perhaps the most challenging year on record. The year began with the community still cleaning up the SUNBURST supply chain compromise and ended with a widespread and easy-to-exploit vulnerability in a common open source tool. In between, ZeroFox Intelligence observed record-setting ransomware incidents, more supply chain compromises, and increased geopolitical tensions in Europe and Asia. ZeroFox also was the first threat intelligence firm to discover a variant of ransomware called Colossus whose operators appeared to be at least highly familiar if not directly associated with other existing Ransomware-as-a-Service groups.

While law enforcement around the world have made progress at tracking and interdicting criminal cryptocurrency activity, and governments have debated new basic security requirements and regulation of cryptocurrencies, ZeroFox Intelligence does not forecast these achievements will result in a decrease in cyber crime for 2022. Software Bills of Material (SBOMs) should improve our visibility into the components and libraries embedded in enterprise software, and attack surface management programs will help reduce data breaches due to “shadow IT.” However, the threat landscape continues to find ways to exploit emerging technologies and business processes in our multi- and hybrid-cloud environments. Cyber criminals will also evolve their techniques for laundering the proceeds of their activities. We are confident 2022 will be another taxing year for security teams around the world.

At ZeroFox, we completed the integration of the former Cyveillance team and acquired Vigilante. The new ZeroFox Intelligence team, led by VP of Intelligence AJ Nash, is now poised for continued growth and delivery of intelligence across the physical and cyber domains. Our ability to detect threat infrastructure and activities increased dramatically as a result of these integrations and acquisitions, allowing ZeroFox to go further and disrupt threat actor infrastructure at a scale unmatched in the industry. Throughout 2022, ZeroFox Intelligence will continue to expand capabilities and improve our collection and analytical tradecraft to answer even more requirements for our customers.

Key Forecasts

• ZeroFox anticipates that ransomware will continue to thrive at an accelerated pace throughout 2022. Organizations in the financial, manufacturing, retail, and healthcare sectors will remain at heightened risk. Ransomware developers are likely to focus on achieving persistence and evolving extortion tactics, including directing threats towards high-profile individuals.
• ZeroFox forecasts a surge in data kidnapping attacks—extortion without the encryption of victim data—in 2022.
• ZeroFox expects more cyber criminals to shift from Bitcoin to Monero as their cryptocurrency of choice in the coming year.
• ZeroFox predicts third-party compromises will continue on an upward trajectory in terms of frequency, scale, and sophistication; threat actor targeting is likely to focus on smaller, third-party vendors within larger supply chains and key events in 2022.
• ZeroFox assesses that remittance-heavy economies will move towards digital currencies in 2022 at an accelerated pace. Because of that trend, more states will continue to attack the cryptocurrency industry in the coming year to generate funds for governments seeking to circumvent various economic sanctions.
• ZeroFox expects competition among infostealer developers to increase in 2022, encouraging innovation aimed at building better, more sophisticated, and easier-to- use services.
• ZeroFox assesses with high confidence that the demand for Initial Access Brokers services will continue to thrive in 2022, with more threat groups or individual actors attempting to sell access given the relatively low risk and high demand from various malicious groups.
• ZeroFox predicts that threat actors will look for and use new Java-based vulnerabilities to recreate the success of Log4j in the coming year.
• ZeroFox anticipates that cyber criminals will continue to use automation to fuel the growth of sophisticated Phishing-as-a- Service kits for sale and license.