Q2 2022 Business Insurance: Quarterly Threat Landscape Scorecard

Q2 2022 Business Insurance: Quarterly Threat Landscape Scorecard

Product Serial: S-2022-10-03a

TLP:CLEAR

ZeroFox Intelligence is excited to announce the release of our Business Insurance Quarterly Threat Landscape Scorecard for Q2 of 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 5:00 PM (EDT) on September 20, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

The insurance industry remains a lucrative target for malicious actors due to the vast amounts of policy holder information insurers possess. Cybercriminals target personally Identifiable Information (PII) held by insurers—including Social Security numbers, health and financial records, phone numbers, and addresses—and leverage such data to commit fraudulent activity or sell it to third parties on deep and dark web (DDW) forums. Specifically, organizations that provide business insurance are very likely to be seen as valuable targets within the broader industry. The compromise of a single business insurer could provide access to multiple downstream targets across various sectors and the opportunity to reach and exploit a wider scope of customer bases, enabling follow-on attacks. As a result, business insurance organizations face a host of potential impacts, including data corruption or data theft, business disruption, and reputational damage.

The attack surface within insurance and financial services more broadly continues to expand, as organizations increasingly adopt digital solutions to modernize infrastructure and improve product offerings. This shift, accelerated by the COVID-19 pandemic, has resulted in insurers driving investment in online services such as web and app-based agency portals, live-data tracking deployed on hybrid cloud platforms, and the adoption of automated underwriting and workflow software. While this provides new business capabilities, it also introduces new attack vectors for threat actors. Additionally, many insurance companies remain reliant on outdated and vulnerable IT systems due to the costs associated with modernizing technology and digitizing client records.

The insurance supply chain is complex, with sensitive customer data and PII often being exchanged by various third parties. Most insurers, for example, utilize independent agents to sell and write policies across various lines of business, presenting opportunities for threat actors to exploit weak security practices at multiple points. As insurers and their supply chains embrace big data and advanced analytics that require handling vast amounts of consumer information beyond current levels yet operate on outdated systems, malicious actors will almost certainly continue to view the industry as a prime target for compromising networks and gaining access to valuable data.

Key Findings

• Threat actors remain motivated to target the business insurers and the broader insurance industry to monetize access to client and network data.
• Criminal actors are most likely to use ransomware and digital extortion to extract the greatest monetary value from the data.
• The threat from saturated loader, infostealer, and trojan marketplaces filled with malware designed to target Windows or Linux-based systems remains prevalent.
• Threat actors are also turning their attention to gaps in third-party vendors’ security practices to exploit stolen data.
• Social engineering remains the most frequently-reported intrusion vector across the insurance sector in 2022 and is expected to remain so for the foreseeable future.
• Cyber espionage poses a threat to the insurance industry from threat actors—typically nation-state or state-sponsored—seeking a competitive advantage or financial return.