Q3 2022 Manufacturing Sector: Quarterly Threat Landscape Scorecard

Q3 2022 Manufacturing Sector: Quarterly Threat Landscape Scorecard

Product Serial: A-2022-11-09a

TLP: CLEAR

ZeroFox Intelligence is excited to announce the release of our Manufacturing Quarterly Threat Landscape Scorecard for Q3 of 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:00 PM (EDT) on October 10, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

The manufacturing sector remained a prime target for malicious actors in Q3 2022 due to its key role in critical infrastructure and the global economy. ZeroFox Intelligence assesses that the threat to the sector will increase in the coming months amidst geopolitical and economic strain, underpinned by politically-inspired targeting. In Q3 2022, manufacturers faced an increased threat from smishing, callback phishing, and threat actors leveraging techniques to bypass multi-factor authentication (MFA). ZeroFox Intelligence recommends implementing phishing-resistant MFA methods that support Fast ID Online Version 2. (FIDO2) and certificate-based authentication. Exploit disclosure in Information Technology and Operational Technology infrastructure continued at a high pace, with threat actors leveraging vulnerabilities in past end-of-life products. The shift to Initial Access Broker (IAB) market sales being made in private channels rather than advertising in open forums will likely continue and make identifying and mitigating access sales ahead of compromise increasingly challenging. Botnet and malware deployment remained high, including infostealers and trojans. Digital extortion attempts against manufacturing targets continued to fall, likely caused in part by difficulty eliciting victims’ payments, although ZeroFox Intelligence has observed an increase in attacks against “big game” manufacturing targets. In coming months, the industry is likely to see an increase in politically-motivated extortion targeting.

Key Findings

• Manufacturing organizations likely faced an increased threat of smishing, callback phishing (vishing), and phishing techniques that bypass MFA.
• Manufacturing organizations continued to face a high risk of threat actors leveraging exploits in products past end-of-life use.
• Advertisements for illicit access into manufacturing organizations plateaued, bucking a downward trend seen in other sectors.
• Despite a likely reduction in threat from ransomware and digital extortion, ZeroFox Intelligence observed an increase in attacks against “big game” manufacturing organizations.
• ZeroFox Intelligence assesses the threats facing the manufacturing sector will more likely than not develop significantly over the next two quarters.