Q3 2022 Public Sector: Quarterly Threat Landscape Scorecard

Q3 2022 Public Sector: Quarterly Threat Landscape Scorecard

Product Serial: A-2022-12-07a

TLP: CLEAR

ZeroFox Intelligence is excited to announce the release of our Public Sector Quarterly Threat Landscape Scorecard for Q3 of 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:00 PM (EDT) on October 10, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

The threat to public sector organizations in Q3 2022 remained broadly consistent with previous quarters, with the ongoing war in Ukraine continuing to shape the cyber threat landscape. ZeroFox Intelligence assesses that the threat to the sector will likely increase in the coming months, underpinned by politically-inspired targeting. There were increases in particular aspects of the social engineering threat, including from smishing, callback phishing, and threat actors leveraging techniques to bypass multi-factor authentication (MFA). ZeroFox Intelligence recommends implementing phishing-resistant MFA methods that support Fast ID Online v2.0 (FIDO2) and certificate-based authentication. The sustained high pace of vulnerability disclosures, particularly in software commonly used by public sector entities, will very likely strain out-of-cycle patch management processes and increase the likelihood of vulnerabilities not being patched in a timely manner. The shift to Initial Access Broker (IAB) market sales being made in private channels rather than advertising in open forums will likely continue and make identifying and mitigating access sales ahead of compromise increasingly challenging. Botnet and malware deployment remained high, with Eastern European public sector bodies in particular likely facing an increased threat from distributed denial-of-service (DDoS) attacks by pro-Russian threat actors. Digital extortion attempts remained below 2021 levels, likely caused in part by difficulty eliciting victims’ payments. However, incidents in Q3 2022 highlighted the high threat of attacks against third-party providers that could implicate multiple downstream customers; in coming months, the sector is likely to see an increase in politically-motivated extortion targeting.

Key Findings

• Public sector organizations likely faced an increased threat of smishing, callback phishing (vishing), and phishing techniques that bypass MFA.
• Vulnerabilities in software commonly used by public sector organizations were added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
• The threat to public sector organizations from IABs increased in Q3 2022
• Most public sector bodies around the world saw a negligible change in the threat from botnets, though Eastern European entities likely faced an increased threat.
• While there were fewer ransomware and digital extortion attempts, threat actors continued to demonstrate a high degree of capability in attacks against critical infrastructure and government functions.