X-Force ThreatIntelligenceIndex 2022

Contents
Executive summary

03

Top attack types

07

Top infection vectors

16

Threats to operational technology and Internet of Things

24

Top threat actors of 2021

29

Trends in malware development

31

Geographic trends

35

Industry trends

42

Risk mitigation recommendations

53

About IBM Security X-Force57

Contributors

59

IBM Security

2

Executive summary
The world continues to grapple with a lasting pandemic,
shifts to work-from-home and back-to-office, andgeopolitical changes spawning a constant drone of
mistrust. All of this equates to chaos, and it is in chaosthat cybercriminals thrive. In 2021, IBM Security® X-Force®
saw how threat actors opportunistically used a shifting
landscape to adopt tactics and techniques to successfully
infiltrate organizations across the globe.
The IBM Security X-Force Threat Intelligence Index maps new trends and attack
patterns we observed and analyzed from our data—drawing from billions of datapoints
ranging from network and endpoint detection devices, incident response (IR)engagements, domain name tracking and more. This report represents the culminationof that research based on data collected from January to December 2021.
We offer these findings as a resource to IBM clients, researchers in the security industry,
policy makers, the media and to the broader community of security professionals andbusiness leaders.
Given the volatile landscape and the evolution of both threat types and threat vectors,
you need threat intelligence insights to stay ahead of attackers and fortify your criticalassets more than ever.

IBM Security

3

Executive summary

Report highlights
Top attack type: Ransomware was again the top attack type in 2021, although thepercentage of attacks X-Force remediated that were ransomware decreased nearly 9%
year-over-year. REvil—a ransomware type X-Force also refers to as Sodinokibi—was
the most common ransomware strain X-Force observed for a second year, making up
37% of all ransomware attacks, followed by Ryuk at 13%. Law enforcement activity has
probably been the primary force driving down ransomware and IoT botnet attacks in
2021, but this does not preclude a potential resurgence in 2022.
Supply chain vulnerabilities: Supply chain security was pushed to the forefront ofgovernment and policymakers’ attention, with the Biden administration’s executive
order on cybersecurity, and guidance from the U.S. Department of Homeland Security,
CISA, and NIST doubling down on zero trust guidance. These guidelines put a spotlighton vulnerabilities and trusted relationships. Vulnerability exploitation was the top initialattack vector in manufacturing, an industry grappling with the effects of supply chainpressures and delays.
Most phished brands: X-Force closely tracked how cybercriminals are using phishingkits throughout 2021, and our research revealed that Microsoft, Apple and Google were
the top three brands criminals attempted to mimic. These mega brands were used
repeatedly in phishing kits, with attackers likely seeking to capitalize on their popularity
and the trust many consumers place in them.
Top threat groups: Suspected Iranian nation-state threat actor ITG17 (MuddyWater),cybercriminal group ITG23 (Trickbot), and Hive0109 (LemonDuck) were some of themost active threat groups X-Force intelligence analysts observed in 2021. Threat groups
worldwide were seeking to augment their prowess and infiltrate more organizations.
Malware they used was embedded with greater defense-evasion techniques, in somecases hosted via cloud-based messaging and storage platforms to get through security
controls. These platforms were abused to hide command and control communicationin legitimate network traffic. Threat actors also continued to develop Linux versions ofmalware, to enable them to cross over to cloud environments more easily.

IBM Security

4

Executive summary

Key stats21%
Ransomware share of attacks
Ransomware was the number one attack type observed by X-Force last year,
decreasing to 21% of attacks from 23% in the previous year. REvil ransomware
actors (aka Sodinokibi) were responsible for 37% of all ransomware attacks.

17 months
Average time before a ransomware gang rebrands or shuts down
Ransomware gangs studied by X-Force had an average lifespan of 17 months
before rebranding or disbanding. REvil, one of the most successful gangs, shut
down in October 2021 after 31 months (two and a half years).

41%
Percentage of attacks exploiting phishing for initial access
Phishing operations emerged as the top pathway to compromise in 2021, with
41% of incidents X-Force remediated using this technique to gain initial access.

33%
Increase in the number of incidents caused byvulnerability exploitations from 2020 to 2021
Four out of the top five vulnerabilities exploited in 2021 were new vulnerabilities,
including the Log4j vulnerability CVE-2021-44228—which was ranked number
two, despite only being disclosed in December.

3X
Click effectiveness for targeted phishing campaigns that add phone calls
The click rate for the average targeted phishing campaign was 17.8%, but targetedphishing campaigns that added phone calls (vishing or voice phishing) were threetimes more effective, netting a click from 53.2% of victims.

IBM Security

5

Executive summary

146%
Increase in Linux ransomware with new code
The percentage of Linux ransomware with unique (new) code increased
year-over-year by 146%, according to Intezer, indicating an increase in thelevel of Linux ransomware innovation.

#1
Manufacturing industry rank for attacks
Manufacturing replaced financial services as the top attacked industry in 2021,
representing 23.2% of the attacks X-Force remediated last year. Ransomware was
the top attack type, accounting for 23% of attacks on manufacturing companies.

61%
Manufacturing share of compromises on OT-connected organizations
Sixty-one percent of incidents at OT-connected organizations last year werein the manufacturing industry. In addition, 36% of attacks on OT-connectedorganizations were ransomware.

2,204%
Increase in reconnaissance against OTAttackers increased their reconnaissance of SCADA Modbus OT devices
accessible via the internet by 2,204% between January and September 2021.

74%
Share of IoT attacks originating from Mozi botnet
In 2021, attacks against IoT devices originated from the Mozi botnet
74% of the time.

26%
Share of global attacks that targeted Asia
Twenty-six percent of all attacks had targets in Asia in their crosshairs.
Asia was the most attacked geography of 2021.

IBM Security

6

Top attack types
For the purposes of this report, we categorize attack
types by the end goal an attacker is seeking toachieve once they have gained access to a victim’s
network. Attack types differ from initial infection
vectors, with the latter being the initial method ofentry into a network.
As examples, some attack types include ransomware, data theft, and
BEC, based on the end goal of the threat actor’s operation. Examples of
initial infection vectors include phishing, using stolen credentials, andvulnerability exploitation.
The following sections provide details and data on the most prolificattack types our data revealed in 2021.

Ransomware
For more than three years, ransomware has been the top attack typeobserved by X-Force, and 2021 was no exception. Twenty-one percent
of attacks remediated by X-Force incident response in 2021 wereransomware attacks. This is down slightly from the year prior, when 23%
of attacks X-Force remediated were ransomware attacks; however, thevolume of ransomware attacks has remained steady year-over-year.

IBM Security

7

Top attack types

27%
23%

Figure 1

Top attack types, 2021 vs. 2020
Breakdown of top attack types, 2020-2021 (Source: IBM Security X-Force)1

5%
13%

23%

7%

8%

21%

6%
6%

5%

5%

5%

5%
Other

9%

14%
10%

8%

Malicious insider

Misconfiguration

RAT

Credential
harvesting
Data theft

BEC

Server access

Ransomware

1

2021

2020

 ther attacks include adware, banking trojans, botnets, cryptominers, defacements,O
fraud, DDoS, point of sale malware, spam, webscripts, webshells, and worms.

IBM Security

8

Top attack types

The frequency of ransomware attacks X-Force observes tends to shift throughout theyear, with May and June tending to see higher frequencies of attacks, while January
tends2 to see lower. In addition, ransomware attacks appear to decrease in late summer
Figureor early fall. Inof2021,
that drop thatlargelycameransomware,in August and again
in November,
Percentage
IR incidents
wereby month.
2021 likely
Percentage
Incident Response
were ransomware,
2020-2021
spurred ofbyX-Forcethe permanentor engagements
temporarythat
shutdownof several
groups in the months prior:(Source: IBM Security X-Force)
DarkSide and Babuk in May, Avaddon in June, and REvil in October.
Figure 2

Percentage of IR incidents that were ransomware, by month, 2020 vs. 2021
Percentage of X-Force Incident Response engagements that were ransomware, 2020-2021 (Source: IBM Security X-Force)

50%

50%

43%

40%
36%

35%
33%
30%

30%

29%

27% 27%
25%

24%

25%

22%
19%

20%

18%
15%

14%

13%
10%

10%

6%

0

IBM Security

6%

0%

0%

Jan

5%

Feb

Mar

Apr

May

Jun

Jul

2020

2021

Aug

Sep

Oct

Nov

Dec

9

Top attack types

According to X-Force research, 17 months is the averagetime before a ransomware group either rebrands or shuts
down, with a median of 18 months. Ransomware groups
often spring up and rebrand once there is a threat ofarrest or action by law enforcement. In some cases, law
enforcement action forces ransomware groups to shut
down entirely. Despite this dynamic environment—or
perhaps because of it—many ransomware actors remain
at large, and X-Force assesses that criminal ransomware
activity will continue into the foreseeable future, basedon the high profits generated by this activity and current
limitations on law enforcement for widely shutting
down ransomware activity. X-Force is aware of many
ransomware actors that have rebranded and continued
operations under new names, with GandCrab to REvil,
Maze to Egregor, and DoppelPaymer to Grief as examples.

“Many ransomware
actors have continued
operations under
new names”

Law enforcement activity is probably the primary factor
driving down the percentage of ransomware attacks
X-Force observed in 2021, but it is very likely that thegroups we have seen disappear will rebrand and reemerge in 2022 under new names and that ransomware
activity will continue.

IBM Security

10

Top attack types

Figure 3

Ransomware groups that have shut down
Sample of ransomware groups that have shut down, 2017-2021(Source: IBM Security X-Force)Feb
2017 May
2019

Jan2018 May2019

Feb2019 Jun
2021

Apr
2019 Oct
2021

May2019 Nov
2020

Jun2019 Jul2021

Aug
2019 Apr2020

Aug2019 Jan
2021

Jan
2020 Aug
2021

Aug
2020 May
2021

Sep
2020 Feb
2021

Oct2020 May
2021

Jul
2021 Nov
2021

2022

2021

2020

2019

2018

2017

2022

BlackMatter

2021
Babuk
Egregor
2020

DarkSide
Ragnarok
NetWalker

2019
Nemty
DoppelPaymer
2018

Maze
REvil/Sodinokibi

2017

Avaddon
GandCrab
HermesIBM Security

Average lifespan: 17 mos.

Median lifespan: 18 mos.

11

Top attack types

Of the ransomware strains observed by X-Force in 2021, REvil made up 37%—over onethird—of all ransomware incidents our team remediated. A strong second was Ryuk,making up 13% of attacks observed last year. REvil actors as of mid-October 2021
appear to have permanently shut down operations, probably due to law enforcement
activity.
Both Ryuk and REvil constitute some of the longest-running ransomware
Figure 4
Types of ransomware
observed
2021
operations,having emergedin Aprilin
2019
and August 2018, respectively.
Ransomware types observed by X-Force Incident Response in 2021
(Source: IBM Security X-Force)

Figure 4

Types of ransomware observed in 2021
Ransomware types observed by X-Force Incident Response in 2021
(Source: IBM Security X-Force)

3%
Xorist3%
Ragnar Locker
3%
Nefilim3%
Medusa3%
Eking
3%
DarkSide3%
Crystal

37%
REvil

3%
CryptoLocker
3%
Conti
3%
BlackMatter
3%
BitLocker
3%
AvosLocker
3%
AtomSilo
7%
LockBit 2.0

13%
Ryuk

How ransomware attacks happen
Given the deep experience X-Force Incident Response (X-Force IR) has in remediating
ransomware attacks, our team has observed a recent pattern emerge across the vast
majority of ransomware attacks. In particular, we have been able to develop a five-stage
model that defines the common pattern observed in most ransomware incidents.

IBM Security

12

Top attack types

Figure 5

Stagesof a ransomware attack
Figure 5

Stage 1: Initial access
The most common access vectors forransomware attacks continue to bephishing, vulnerability exploitation,and remote services such as remote
desktop protocol.

Standard attack flow for ransomware attacks, as observed by
X-Force Incident Response (Source: IBM Security X-Force)
Standard attack flow for ransomware attacks, as observed by
X-Force Incident Response (Source: IBM Security X-Force)

Stages of a ransomware attack

Stage 1: Initial access
Initial access:Phishing email or
exploit of internetfacing service

Persistant accessestablished:task, run key,
RAT, etc.

Commandand control

Stage 2: Post exploitation
Depending on the initial access vector,
the second stage may involve anintermediary remote access tool (RAT)or malware prior to establishing interactive
access with an offensive security tool suchas Cobalt Strike or Metasploit.

Stage 2: Post exploitation
Second stage malware/post-exploitation toolkit

Interactive attacker
establishes access tosystemStage 3: Understand and expand
Gather credentials• Local reconnaissance:
Local users, groups,
tasklist, etc.

SMB lateral
movement• Active Directoryreconnaisance:
Gather list of domain
admins and domain
controllers

Obtain domain
administrator
privilegesStage 5: Ransomware deployment
Stage ransomware
on share

IBM Security

Gather credentials• Gather lists ofhostnames/
subnets to target
for ransomware.
• Gather lists ofdata sources

Stage 4: Data collection and exﬁltration
Data exﬁltration(WinSCP, Rclone, etc.)

Reconnaissance

Deploy ransomware
using domain
adminstrator
credentials via
PsExec/SMB/
group policy

Stage 3: Understand and expand
During the third stage of the attack,attackers have consistently focusedon understanding the local system anddomain that they currently have accessto and acquiring additional credentials
to enable lateral movement.
Stage 4: Data collection and exfiltration
Almost every ransomware incident X-Force
IR has responded to since 2019 has
involved the “double extortion” tactic ofdata theft and ransomware. During stage 4of the attack, the focus of the ransomware
operators switched primarily to identifying
valuable data and exfiltrating it.
Stage 5: Ransomware deployment
In almost every single ransomware
incident X-Force IR has responded to, theransomware operators targeted a domain
controller as the distribution point for the
ransomware payload.

13

Top attack types

A concerning new trend in ransomware has been the expansion of “triple extortion”
tactics. In this type of attack, threat actors encrypt and steal data and also threaten
to engage in a distributed denial of service (DDoS) attack against the affectedorganization. This kind of attack is particularly problematic for organizations
because victims have their networks held hostage with two kinds of malicious
attacks—often simultaneously—and are then further victimized by the theft (and
often leak) of data.

11%
of attacks wereserver access

Ransomware gangs are beginning to look to their primary victim’s extended
business partners to pressure them into paying a ransom to prevent their own
data leakages or business disruptions caused by the ransomware attack.

Server access
Server access attacks—where the attacker gained unauthorized access to a server,
but the final end goal is unknown—was the second-most common attack type,making up 11% of all incidents X-Force IR team remediated in 2021.
The majority of these attacks occurred in Asia, and in many cases the threat actors
were successful in deploying malware or employing penetration testing tools on
a server, including China Chopper Webshells, Black Orifice malware, Printspoofer,and Mimikatz.
In some instances, the threat actors exploited a known vulnerability, such as
CVE-2020-7961, which would allow for remote code execution on a server.
In multiple cases threat actors exploited vulnerabilities in Microsoft Exchange
servers to gain unauthorized access to networks of interest. These vulnerabilities
are included in the top 10 vulnerabilities of 2021 listed below.
Some of the server access attacks observed by X-Force’s IR team may havebeen failed attempts to steal data or deploy ransomware. Thus, while companies
aim to prevent attackers from gaining any level of unauthorized access to their
networks, it’s likely that a high number of server access attacks indicates thatorganizations are identifying and eradicating attacks before they progress into
more damaging operations.

IBM Security

14

Top attack types

Business email compromise
After a downturn in business email compromise (BEC) attacks in 2020, X-Force observed
a decrease in this attack type again in 2021. BEC was the third-most common attack
type remediated by our X-Force IR team. Last year, we theorized that widespread
implementation of multifactor authentication (MFA) was decreasing the number ofsuccessful attacks BEC threat actors were able to execute. That theory held in 2021,
since BEC attackers may have realized greater success by shifting focus to geographies
Figure 6
where MFA is not as widely implemented.

Percentage of incidents that were BEC, 2021
Percentage of incidents that were BEC in each region, 2021

For
example,
Latin
American organizations appeared to be bearing the brunt of BEC(Source:
IBM Security
X-Force)
attacks the X-Force IR team is remediating. North American organizations were still
strongly in the crosshairs of BEC operations, but the surge we noticed against Latin
American organizations suggests that BEC attackers shifted the geographic focus of theiroperations: zero percent of attacks against Latin American organizations were BEC in
2019, but 19% of attacks were BEC in 2020 and 20% of attacks in 2021 were BEC.
Figure 6

Percentage of incidents that were BEC, 2021
Percentage of incidents that were BEC in each region, 2021 (Source: IBM Security X-Force)

Latin America

20.0%

11.6%

North America

5.9%

EuropeAsia

4.3%

Middle East
and Africa

0.0%0

IBM Security

5%

10%

15%

20%

15

Top infection vectors
In addition to examining the end goal of threat actors X-Forceobserves, our team also tracks how threat actors gain initialaccess to victims’ networks. Phishing and vulnerability
exploitation tend to be the most common methods we observe,
Figure 7
followed by use of stolen credentials, brute force, remote
Top infection vectors, 2021 vs. 2020
desktop
protocol(RDP),
removable
Breakdownof infection
vectors observedby X-Force
Incident Response,media
2020-2021 and password(Source: IBM Security X-Force)
spraying making up a small percentage of intrusions.
Figure 7

Top infection vectors, 2021 vs. 2020
Breakdown of infection vectors observed by X-Force Incident Response, 2020-2021 (Source: IBM Security X-Force)

41%

Phishing

33%
34%

Vulnerability
exploitation

35%
9%Stolencredentials

18%
6%

Brute force

4%
4%

Remote desktop

7%
4%

Removable media

0%
1%

Password spraying

0%
0

10%

20%

2021

IBM Security

30%

40%

50%

2020

16

Top infection vectors

Phishing
Phishing emerged as the top infection vector in 2021, surpassing vulnerability exploitation, which took
the lead in 2020. Phishing was observed in 41% of the incidents X-Force remediated. While vulnerability
Percentage
of attacks tied to phishing, vulnerability exploitation,
exploitation
in Q3
2021, thesignificant number of phishing-related incidents X-Forceandstolen dominatedcredentials,
by ofquarter,
2021
observedin Q1linked
andwith
Q4various
pushedthisvectors,
infection
vectorinto the lead for the year.
Percentage
of attacks
infection
by quarter,in 2021
Figure 8(Source: IBM Security X-Force)

Figure 8

Percentage of attacks tied to phishing, vulnerability exploitation,and stolen credentials, by quarter, 2021
Percentage of attacks linked with various infection vectors, by quarter, in 2021 (Source: IBM Security X-Force)
52%
50%

47%

42%
40%

37%

36%

31%

30%

30%

23%

22%

20%

10%

7%
5%

0%

0%

Q1

Q2
Phishing

Vulnerability exploitation

Q3

Q4

Stolen credentials

Part of X-Force Red’s focus areas include conducting social engineering penetration testing attacks
through phishing emails. For targeted phishing campaigns in 2020 and 2021, the average click rate for
an X-Force Red simulated campaign was 17.8%. When vishing (voice phishing) phone calls were added
to the campaign, the click rate rose to 53.2%, three times as effective.
BEC attackers have leveraged phishing campaigns and social engineering with great success.
And particularly in 2021, X-Force observed ransomware actors rely even more heavily on phishingcampaigns to gain initial access to victim networks for ransomware attacks.
IBM Security

17

Top infection vectors

For example, multiple REvil ransomware incidents observed in 2021 began with a QakBot phishingemail. These emails usually have very short messages, often refer to unpaid invoices, and occasionallywill even hijack ongoing email conversations and reply all with only a malicious attachment.
When opened, the document will instruct the recipient to enable macros which will drop the QakBot
banking trojan, gaining an initial foothold on a system. The operation is then transferred to REvil
ransomware actors who conduct reconnaissance and proceed with the operation from there.
A sample QakBot phishing email is included in figure 9.
Figure 9

Sample QakBot phishing email
Example of QakBot phishing email with malicious attachment (Source: IBM Security X-Force)

IBM Security

18

Top infection vectors

When the recipient attempts to open the attachment, they are prompted by a popup(see figure 10) to enable macros by choosing “Enable editing” and “Enable content.”
This allows the threat actor to deploy malware on the victim’s machine with theassistance of malicious macros.
Figure 10

Sample popup message from QakBot phishing attachment
Message in malicious attachment prompting the recipient to enable macros (Source: IBM Security X-Force)

Phishing kit deployments short-lived,
abuse technology and bank brands
IBM analyzed thousands of phishing kits from around the world to determine thefrequency and effectiveness of this particular attack vector. Our investigation suggeststhat malicious actors who use phishing kits probably put in tedious hours with limited
gains. In particular, our investigation showed that:— Phishing kit deployments generally had a short lifespan, with almost one-third of
deployed kits being used for no longer than a day. In some cases, an individual
deployment of a phishing kit lasted only seven-to-eight hours before most hosting
providers identified the site as malicious and blocked it.
— Each deployment on average had no greater than 75 potential victims who visited
the site.
— Phishing kits asked for user credentials (email/ID/password combinations) in nearly
every kit observed (close to 100%), followed in popularity by credit card data (61%of requests), mailing address (40%), phone number (22%), date of birth (17%),
identity card number (15%), security questions (14%), and ATM PINs (3%).

IBM Security

19

Top infection vectors

In addition, X-Force looked at which brands were most frequently
spoofed in phishing kits. The top brands included large technology
companies and large financial institutions. The top 11 brands arelisted below.

222,127
phishing attacks inJune 2021, setting an
all-time record highTop 11 most spoofed brands of 2021
1. Microsoft
2. Apple
3. Google
4. BMO Harris Bank (BMO)
5. Chase
6. Amazon
7. Dropbox
8. DHL9. CNN
10. Hotmail
11. Facebook

The Anti Phishing Work Group (APWG) noted that June 2021 set an
all-time record high with 222,127 phishing attacks that month alone.
X-Force assesses with high confidence that phishing kits will continue tobe used by threat actors due to their easy-to-use nature and low resource
requirement. Monitoring for suspicious connections to likely spoofed
brands can help organizations minimize the probability of impact fromthis attack vector.
Using a DNS service that’s dedicated to data privacy, like Quad92, canalso help mitigate the risk of phishing attacks.

2

IBM Security X-Force is a Quad9 partner.

IBM Security

20

Top infection vectors

Vulnerability exploitation
Despite dropping to the second-most common in 2021, the number of incidents
that were caused by vulnerability exploitation this past year rose 33% from 2020,
indicating this attack vector’s strong hold in threat actors’ arsenals. This vector
allows threat actors to gain access to victim networks for further operations—in many cases with elevated privileges.
X-Force observed actors leveraging multiple known vulnerabilities, such as
CVE-2021-35464 (a Java deserialization vulnerability) and CVE-2019-19781(a Citrix path traversal flaw), to gain initial access to networks of interest. In addition,
we observed threat actors leverage zero-day vulnerabilities in major attacks likethe Kaseya ransomware attack and Microsoft Exchange Server incidents to accessvictim networks and devices.
Near the end of 2021, widespread exploitation of the Log4j vulnerability
CVE-2021-44228 also launched this vulnerability into second place in X-Force’s
top 10 list for 2021. Several mitigation measures can assist your organizationin avoiding becoming a victim of this vulnerability.

IBM Security

21

Top infection vectors

Number of vulnerabilities hit another record highOver the past five years, the number of vulnerabilities discovered per year his risen
steadily. Even more concerning is that the number of exploits—tools threat actors canuse to exploit a vulnerability—are also rising steadily, creating an ever-expanding arrayof options for threat actors seeking to exploit vulnerabilities.
Vulnerabilities related to Internet of Things (IoT) and industrial control systems (ICS)
increased at an even faster rate than overall vulnerabilities, with these two categories
Figure 11
experiencing a 16% and 50% year-over-year increase respectively, compared to a 0.4%
Vulnerabilities discovered by year, 2011-2021
growth rate in the number of vulnerabilities overall.
New vulnerabilities identified each year, 2011-2021, and cumulative numberof vulnerabilities (Source: IBM Security X-Force)
Figure 11

Vulnerabilities discovered by year, 2011-2021
New vulnerabilities identified each year, 2011-2021, and cumulative numberof vulnerabilities (Source: IBM Security X-Force)

50K

200K

45K

180K

40K

160K

35K

140K

30K

120K

100K

25K
16,621

20K

17,997

19,13780K

11,212

15K

10K

17,85919,649

7,380

8,460

8,661

9,666

60K

9,875
40K

5K

0

20K

2011

2012

2013

2014

2015

2016
Per year

IBM Security

2017

2018

2019

2020

2021

0

Cumulative

22

Top infection vectors

Top 10 vulnerabilities of 2021
While any vulnerability carries risk and should be assessed, the following list includes the top
vulnerabilities that X-Force IR observed threat actors exploit or attempt to exploit during the courseof operations in 2021. X-Force recommends prioritizing patching of these vulnerabilities if yourorganization has not done so already.
1. CVE-2021-34523 – Microsoft Exchange server flaw
enabling malicious actors to bypass authenticationand impersonate an administrator. Known genericallyas ProxyLogon.
2. CVE-2021-44228 – Vulnerability in Apache
Log4j Library
3. CVE-2021-26857 – Microsoft Exchange
Server remote code execution vulnerability
4. CVE-2020-1472 – Netlogon elevation ofprivilege vulnerability
5. CVE-2021-27101 – Accellion FTA
vulnerability susceptible to SQL injection

IBM Security

6. C
 VE-2020-7961 – Liferay Portal deserializationof untrusted data allows for remote code execution
via JSON web services
7. C
 VE-2020-15505 – MobileIron vulnerability allowing
for remote code execution
8. C
 VE-2018-20062 – NoneCMS ThinkPHP remote code
execution vulnerability
9. C
 VE-2021-35464 – ForgeRock AM server Javadeserialization vulnerability allows for remotecode execution
10. C
 VE-2019-19781 – Citrix Server path traversal flaw

23

Threats to operational technology and Internet of Things
Known vulnerabilities related to industrial control systems (ICS)—
and, by extension, operational technology (OT)—as well as Internetof Things (IoT) vulnerabilities are increasing each year, with anappreciable increase in identified vulnerabilities from 2020 to 2021.
As more “things” come alive with the power of digitization and internet protocols, so do newvulnerabilities and risks. While many of these issues affect only industrial organizations, anyorganization that uses IoT in its infrastructure is also increasingly exposed to risk.
In addition to this increased digitization, the dynamics of supply chains are affecting the attack
surface for many OT-connected organizations. Threat actors understand the critical role manufacturing
Figure 12
and energy play in global supply chains and are seeking to disrupt these organizations because of the
SCADA Modbus reconnaissance volume,
ripple effect it can have across multiple industries and the pressure these multiplying effects create
breakdown by month, 2021
for victims to pay a ransom.
Month-by-month breakdown of SCADA Modbus reconnaissance activity, 2021
(Source: IBM Security X-Force)

Threat actors acceleratereconnaissance against
OT devices
Analyzing data from 2021, X-Force observed attackers
conducting massive reconnaissance campaigns
searching for exploitable communications in industrial
networks. Specifically, 2021 saw a considerable increase
in reconnaissance activity targeting TCP port 502.
This port uses Modbus, an application layer messaging
protocol used to provide client-to-server communication
between connected buses, networks, and programmable
logic controller (PLC) devices in industrial networks.
Port 502 is commonly used by supervisory control anddata acquisition (SCADA). Access to Modbus could allow
threat actors to control physical devices connected tothe internet.
Between January and September of 2021,
X-Force observed a 2204% increase in adversarialreconnaissance activity targeting port 502.

Figure 12

SCADA Modbus reconnaissance volume,
breakdown by month, 2021
Month-by-month breakdown of SCADA Modbus reconnaissance activity, 2021
(Source: IBM Security X-Force)

30%

30

25

20%

20

18%
15

10

8%

5

0

3%
3%

2%

1%
Jan

IBM Security

4%

3%

Feb

Mar

Apr

May

Jun

Jul

4%

3%

Aug

Sep

Oct

Nov

Dec

24

Threats to operational technology and Internet of Things

Threat actors may have heightened Modbus reconnaissance to begin finding targets toransom or seize control and cause harm. Given Modbus’s lack of security features, once anattacker has found an accessible Modbus device, they could then issue harmful commands
to the device and impact connected ICS or IoT systems.
Although SCADA Modbus resides in Level 2 of the Purdue Model within ICS environments—
which ideally should be segmented from the enterprise network and placed behind a
demilitarized zone—in some cases the SCADA Modbus port 502 can be accessed directly
over the open internet. Lack of authentication and transmission of messages in plain text
are some additional aspects of Modbus that make it less secure when compared to other,more modern technologies.

Manufacturing most targeted of OT industries,
ransomware leads
In terms of industries with OT networks, X-Force observed manufacturing was the most
attacked in 2021 by a significant margin, victimized in 61% of incidents X-Force assisted
in remediating. Ransomware actors in particular find manufacturing to be an attractive
target, likely due to these organizations’ low tolerance for down time.

IBM Security

25Threats to operational technology and Internet of Things

Figure 13

OT industries targeted, 2021
Breakdown of attacks against six operational technology industries targeted,as observed by X-Force IR, 2021 (Source: IBM Security X-Force)

61%

Manufacturing

1%

Heavy and civilengineering

IBM Security

7%
Mining10%

Utilities

10%

Transportation

11%
Oil and gas

26Threats to operational technology and Internet of Things

For all industries with OT networks where X-Force observed attacks in 2021—
engineering, mining, utilities, oil and gas, transportation and manufacturing—ransomware
again led the charge for attack types, accounting for 36% of all attacks and echoing
the overall attack trend across all industries. While the IT networks were compromisedin the vast majority of these attacks, the impact carried over to victims’ operational
technology in many of these instances.
Other top attack types included server access, DDoS, RATs, insiders, and credential
harvesting operations.

Figure 14

Attack types on OT, 2021

Breakdown of attack types on operational technology, 2021
(Source: IBM Security X-Force)
Figure 14

Attack types on OT, 2021
Breakdown of attack types on operational technology, 2021
(Source: IBM Security X-Force)

2%
Worm
2%
Webshell4%
Botnet9%
RAT

9%Insider36%
Ransomware

9%
Credential
harvesting

11%
DDoS

IBM Security

18%
Server access27

Threats to operational technology and Internet of Things

Mozi botnet continues to threaten IoT and OT assets
Figure 15

IoT attack volume breakdown by quarter, 2018-2021

Since
2019,
X-Forcehasbyidentified
a high volume of IoT malware activity—including a nearly
IoT malware
activity,
broken down
quarter, 2018-2021(Source: IBM
Security
X-Force) Q3 2019 and Q4 2020. The Mozi botnet continued to make up the most
3000%
surge
betweensignificant volume of IoT malware compared to all other IoT malware types, at 74% of the total
volume of IoT malware X-Force observed in 2021.
Figure 15

IoT attack volume breakdown by quarter, 2018-2021
IoT malware activity, broken down by quarter, 2018-2021 (Source: IBM Security X-Force)

20%

19%
17%

15%
13%

11%

10%

10%

9%
6%

6%

6%

Q4

Q1

Q2

5%

1%
0

1%

0%

1%
0%

Q3

Q4
2018

Q1

Q2

Q3
2019

Q3
2020

Q4

Q1

Q2

Q3

Q4

2021

Mozi abuses weak Telnet passwords and exploits vulnerabilities to target networking devices, IoT, andvideo recorders, among other internet-connected products. Post-infection, it is capable of maintaining
persistence on network gateways, which can be particularly effective initial access points for lateral
movement to high-value networks, including OT and ICS networks. In addition, by infecting routers,
threat actors behind Mozi can position themselves to conduct man-in-the-middle attacks that lead toransomware deployment, including attacks on OT networks.
In addition to Mozi’s access and lateral movement capabilities, a large Mozi botnet that infects a large
number of security cameras or similar IoT devices at an organization can diminish an organization’s
ability to effectively conduct physical security operations.
Chinese law enforcement reportedly arrested the authors of the Mozi botnet in June and August 2021,
and the decrease in IoT attack volume in Q4 2021 is probably a side-effect of these arrests.
IBM Security

28

Top threat actors of 2021
Our 2021 IR data show that where a threat actor could be
identified, cybercriminals were the leading source of attacks.
Nation-state actors made up only 2% of the engagements X-Force remediated in 2021,
underscoring the high volume of activity generated by cybercriminal activity. The nationstate actors we observed were largely seeking to conduct espionage and surveillance,
and in some cases, may have been laying the groundwork for future sabotage. Only 1%of the activity we observed was from hacktivist groups.
Figure 16

The following sections provide additional detail on some of the more interesting andThreat actors observed by
active threat groups X-Force observed in 2021.

X-Force Incident Response, 2021

Threat actor groups observed by X-Force IR, broken down
Figureby type,162021 (Source: X-Force)

Threat actors observed by
X-Force Incident Response, 2021

Threat actor groups observed by X-Force IR,
broken down by type, 2021 (Source: IBM Security X-Force)1%
Hacktivist
2%
Nation-state

97%
Criminal

IBM Security

29

Top threat actors of 2021

Suspected Iran-based ITG17
uses Aclip backdoor
In 2021, IBM Security X-Force observed a threat actor using a new backdoor that
X-Force named “Aclip.” In addition, the adversary leveraged a legitimate messaging andcollaboration application tool likely to obfuscate operational communications, allowing
malicious traffic, or traffic with underlying malicious intent, to go unnoticed. Based on
the tools, tactics, and infrastructure observed, we assess with moderate confidence thatthe threat actor we track as ITG173 (aka MuddyWater), a suspected Iranian nation-stategroup, was behind this activity for the possible purpose of surveillance.

ITG23—Trickbot Gang—enables
Conti ransomware operations
X-Force analysts have been closely tracking the cybercriminal group behind the Trickbot
banking trojan—a group we identify as ITG23, also known as Wizard Spider or Trickbot
Gang. Phishing emails with the Trickbot trojan are often used as an entry point forConti ransomware, and X-Force has observed that an uptick in ITG23 Trickbot activity
coincided with an uptick in Conti ransomware attacks.
The group has relied on email campaigns delivering malicious Excel documents, as wellas the notable BazarCall campaign, in which subscription themed emails encourage
recipients to contact a fraudulent call center where the telephone operator then guides
the user to download the BazarLoader malware, under the guise of unsubscribing from aservice. Additionally, the group has more recently been hijacking email threads and willthen “reply all” with malicious attachments.

Hive0109 active in 2021
X-Force observed multiple Hive0109—also known as LemonDuck—compromises in
2021, and the group has proven itself adept at leveraging the ProxyLogon vulnerabilities
to compromise unpatched Microsoft Exchange servers. LemonDuck targets both Linuxand Windows systems and is known to capitalize on news-worthy events for phishinglures in its campaigns.
LemonDuck is persistent malware that was primarily used to mine cryptocurrency.
It has likely been active at least since 2018 and has since evolved into a large botnet.
LemonDuck propagates quickly and acts as a first-stage loader for subsequent malware
and attacks. It continues to mine for crypto coins on infected devices.

3

I TG stands for IBM Threat Group. This is IBM X-Force’s naming convention for threat actor groups—
both nation-state and cybercriminal. IBM tracks and names threat groups numerically, identified by
IBM Threat Group (ITG) followed by an assigned number. For threat groups still in the research phase,
we use the designation Hive, as in Hive0109 discussed in this section.

IBM Security

30

Trends in malware development
Threat actors continue to innovate and find new ways to makemalware more capable across operating systems and morechallenging to detect. This section describes some of thetrends in malware development X-Force observed in 2021.

Next-level detection evasion
X-Force’s malware reverse-engineering team uncovered over the last year significant
upgrades in malware evasion techniques.
— Ransomware authors were employing different encryption techniques to avoid hostbased detection systems. One example is intermittent encryption, where separated
blocks of data are encrypted rather than the entire system, which speeds theencryption process.
— Command and control (C2) communications were increasingly using popular cloudmessaging and storage services to blend into legitimate traffic. Additionally, the useof DNS for tunneling C2 communications was also becoming more prevalent.
These techniques help attackers mask C2 activity from network-based sensors
by posing as legitimate communications.
— Malware authors were utilizing increasingly sophisticated packing and code
obfuscation techniques to hide the true purpose of the malware and hinder analysis
attempts. Malware developers also experimented with different programming
languages such as PureBasic and Nim to decrease the ease of reverse engineering.

Malware focus on Docker
Analyzing malware trends impacting cloud environments, X-Force IR observed multiple
malware families shifting their sights from targeting generic Linux systems to focusing
on Docker containers, often used in platform-as-a-service cloud solutions.
Some malware families illustrating this shift include XorDDoS, Groundhog and Tsunami.
This Docker-focused push expands beyond just bots, also highlighting the malicious
activity of IoT malware (Kaiji), cryptominers (Xanthe, Kinsing) and other malware strainsthat aim to leverage the power of cloud computing to scale their mining power.
Threat actors have also been observed targeting other container platforms in addition
to Docker. For example, the Siloscape malware was found compromising vulnerable
Windows containers and the Kubernetes container management platform. Siloscape isincreasingly incorporated into attacks by actors such as TeamTNT, a cybercrime gangthat’s been focusing on cloud platforms to expand the reach of its cryptojacking botnets.

IBM Security

31

Trends in malware development

Ransomware focus on ESXi
Analyzing malware trends impacting Linux environments, X-Force observed multiple
ransomware families shifting their sights to target Linux-based VMWare ESXi servers.
As more organizations increasingly rely on virtualization, ransomware authors are
discovering that it can be more effective to encrypt the virtual machine (VM) files
themselves, rather than infecting the operating systems running within them.
In 2020, X-Force IR observed a Linux variant of the SFile ransomware deployed against
an ESXi server, and in 2021 a number of other ransomware families appeared to follow
suit, including REvil, HelloKitty, Babuk, and BlackMatter. These variants will often makeuse of ESXi’s own command line management tool esxcli to enumerate and shut down
running VMs before encrypting them.

Nim is in
In 2020, cross-platform malware developers gravitated to Golang as a programming
language of choice, since it could be compiled for multiple operating systems at once.
While Golang is still in use in 2021, additional languages such as Nim are becoming
more popular. For example, threat actors used Nim to compile the Nimar backdoor
as well as a version of Zebrocy—a malware type used by Russian nation-state actor
ITG05 (aka APT28).

IBM Security

32

Trends in malware development

Linux threats
continue to evolve
Analysis by IBM Security X-Force ThreatIntelligence partner Intezer found thatover the last year, malware targeting Linux
environments dramatically increased,
indicating continued threat actor interestin this space.

Linux malware with unique code in five categories, 2020-2021(Source: Intezer)

Figure 17

Linux malware with unique code, 2021 vs. 2020
Linux malware with unique code in five categories, 2020-2021 (Source: Intezer)

14.0%

Ransomware

5.7%
12.8%

Banker

0.9%
12.6%

TrojanIntezer analyzes code uniqueness of
malware strains to measure innovation.
Malware code with more unique variations
indicates more innovation has been used
to edit the malware, whereas malware withmostly recycled code has less innovation.
Using this methodology, the following
results were reported.
Linux malware saw unique code increasein four out of five categories since theprevious year, with the greatest increase
being observed in banking trojans, which
saw innovation increase over tenfold.
This increase in Linux targeting may becorrelated to organizations increasingly
moving into cloud environments, which
frequently rely on Linux for their operation.
The level of innovation of Linux malware
came close to that of Windows-based
malware, highlighting just how prevalentLinux malware innovation has become,a trend that we are sure to see increasing
in 2022 as well.

6.2%
10.9%

Figure 18
Miner

13.2%

Malware with unique code, Linux vs. Windows, 2021
Comparison of new Linux malware vs. new Windows malware, 2021
9.3%
Botnet(Source:Intezer)
2.2%
0

5%
2021

15%

2020

Figure 18

Malware with unique code, Linux vs. Windows, 2021
Comparison of new Linux malware vs. new Windows malware, 2021 (Source: Intezer)

14.0%

Ransomware

15.3%
12.8%
13.9%

Banker

12.6%

Trojan

14.2%
10.9%

Miner

13.4%
9.3%

Botnet

14.3%
0

5%
Linux

IBM Security

10%

10%

15%

Windows

33

Trends in malware development

Threat actors target cloud environments
IBM research into the cloud security threat landscape highlighted threat actors’
continued efforts to shift targeting into cloud environments. Data gathered showedthat threat actors used a variety of methods to gain initial access into organizations’cloud assets, with nearly a quarter of incidents stemming from threat actors pivoting
into the cloud from on-premise networks. In addition, API misconfiguration issues
were involved in nearly two-thirds of studied incidents. This targeting coincidedwith a robust underground marketplace for cloud-related credentials, with tens of
thousands of accounts for sale online.
As organizations move into the cloud, threat actors are following right alongside.
Maintaining properly hardened systems, enacting effective password policies, andensuring policy compliance is critical to maintaining a robust cloud security posture.

Fileless malware in the cloudEvasive, fileless malware lurking in memory can elude standard detection tools by
exploiting legitimate scripting languages and sidestepping the use of signatures.
X-Force research has found that, besides using scripts to launch fileless malware,
threat actors are now using Ezuri, an opensource crypter and memory loader written
in Golang, which makes it even easier to launch undetected malware.
X-Force research has also highlighted the development of a new malware suite dubbed
VermillionStrike. VermillionStrike is based on the popular penetration testing tool
CobaltStrike; however, unlike its counterpart, VermillionStrike is designed to run on
Linux systems. This development highlights the continued migration to malware
targeting Linux, and likely indicates ongoing operations outside of Windows
environments will continue into the future.

IBM Security

34

Geographic trends
For the first time since this report began
documenting geographic trends, Asia has moved
into first place as the most-attacked region in 2021,
receiving 26% of attacks X-Force observed last year.
A flurry of attacks on Japan in particular—potentiallyrelated to the Summer Olympic Games held inJapan in 2021—appear to have contributed to this
attack trend.
Europe and North America followed closely behind, garnering 24% and
23% of attacks respectively, and the Middle East and Africa and Latin
America received 14% and 13% of attacks respectively.

IBM Security

35

Geographic trends

Figure 19

Breakdown of attacks bygeography, 2021 vs. 2020
Source: IBM Security X-Force

North
America

EuropeAsia

Latin
America

Middle East
and Africa

9%
13%
9%
14%
27%
23%
31%
24%
25%
26%

IBM Security

2021

2020

36

Geographic trends

Asia
For the purposes of reporting, IBM considers Asia to include Australia,
East and Southeast Asia, India, and the Pacific islands.

Top attacked industries

Server access attacks (20%) and ransomware (11%) were
the top two attack types on Asian organizations in 2021,
followed closely by data theft (10%). The high percentage
of server access attacks in Asia suggests that Asian
organizations are adept at identifying attacks quickly
before they escalate into more concerning attack types.
Remote access trojans and adware tied for fourth place,
at 9% of attacks.

1. Finance and insurance30%

2. Manufacturing29%

3. Professional andbusiness services

13%

In Asia, REvil made up 33% of ransomware attacks
X-Force observed, and Bitlocker, Nefilim, MedusaLocker
and Ragnar Locker were significant players as well.
Vulnerability exploitation and phishing tied for the
top infection vector at Asian organizations in 2021,
both leading to 43% of attacks observed in the region.
Brute force (7%) and use of stolen credentials (7%)
were also occasionally employed to gain initial accessto networks.
In Asia, finance and insurance organizations wereattacked most frequently, making up 30% of theincidents X-Force remediated, followed closely
by manufacturing (29%) and then more distantly
by professional and business services (13%) andtransportation (10%). Globally, finance and insurance
was the top-attacked industry X-Force observed from2015-2020, so Asia experienced a continuation of thisworldwide trend X-Force has observed for years.
Japan, Australia and India were the most-attacked
countries in Asia.

IBM Security

37

Geographic trends

EuropeFor the purposes of reporting, IBM considers European organizations
to be located in Western Europe, Eastern Europe, and Turkey.

Top attacked industries

Europe emerged as the second-most attacked region
in the world, receiving 24% of the attacks X-Force incident
response team observed. Ransomware was the top attack
type for Europe, making up 26% of all attacks in theregion in 2021. Server access (12%) came in second
place, followed by data theft (10%), misconfiguration(8%), malicious insiders (6%) and fraud (6%).
Ransomware attackers are potentially drawn by the
number of high-revenue-generating organizations in
Europe that might be potential targets for ransomware.
REvil attacks made up 38% of ransomware attacks on
Europe in 2021 and Ryuk another 25%. DarkSide, LockBit
2.0, and Crystal ransomware groups were also observed.
These ransomware groups tend to pursue “big gamehunting,” or targeting significant portions of enterprisenetworks belonging to large, wealthy corporations withthe end goal of a big ransom payout.

1. Manufacturing

25%

2. Finance and insurance18%

3. Professional andbusiness services

15%

Vulnerability exploitation was the top infection vector
used against European organizations, accounting for
46% of all incidents X-Force remediated in Europe,and followed closely by phishing at 42%. Brute force
was used in 12% of incidents.
Manufacturing was the top attacked industry in Europe
in 2021, with 25% of attacks, followed by finance andinsurance (18%) and then professional and businessservices (15%). Ransomware attackers’ focus on
manufacturing and professional services organizations
was probably driving these trends.
The United Kingdom, Italy, and Germany were themost-attacked countries in Europe.

IBM Security

38

Geographic trends

North America
For the purposes of reporting, IBM considers North America to include theUnited States and Canada.

Top attacked industries

North America emerged as the third-most attacked region in
the world in 2021, receiving 23% of the attacks X-Force incident
response team observed. Similar to Europe, ransomware led
as the top attack type on North American organizations, making
up 30% of all attacks in this region. It’s possible that the increased
law enforcement activity in 2021, including the takedown of botnets
and ransomware groups, are beginning to impede the attack rate
we traditionally observed in the region.

1. Manufacturing

28%

2. Professional andbusiness services

15%

3. Retail and wholesale

11%

REvil attacks made up 43% of the ransomware attacks
X-Force observed in North America, and X-Force also observed
LockBit 2.0, Conti, CryptoLocker and Eking. After ransomware,
BEC was the second-most common attack type in North America,
making up 12% of attacks and suggesting that BEC attackers
have renewed their assault on North American organizations,seeking to compromise organizations that do not have MFA
deployed. Server access attacks (9%) came in third place
for North American organizations.
Phishing appears to be the attack vector of choice for threat actors
targeting North America, observed in 47% of the incidents X-Force
remediated in this region in 2021. Vulnerability exploitation camein second at 29%, and removable media (12%), brute force (9%)
and stolen credentials (9%) were also used. Threat actors may
be focused on phishing as more North American organizations
implement robust patch management programs in the face ofseveral critical vulnerabilities released in 2020 and 2021.
Manufacturing was the top-attacked industry in North America,
constituting 28% of all attacks X-Force remediated—an attack rate
probably associated with the significant supply chain-related strain
on manufacturing emerging from the pandemic. Professional andbusiness services came in second place at 15%, followed by retail
and wholesale at 11%. Manufacturing, professional services andwholesale are all attractive targets for ransomware actors possibly
due to their low tolerance for downtime and sensitive client data on
their networks that—if stolen and threatened to be leaked—can put
intense pressure on a victim to pay a ransom.
IBM Security

39

Geographic trends

Middle East and Africa
For the purposes of reporting, IBM considers the Middle East and Africa toinclude the Levant, Arabian Peninsula, Egypt, Iran and Iraq, and the entire
African continent.

Ransomware and server access attacks were the top
incident types for the Middle East and Africa, tying forfirst place with 18% of attacks each. Misconfiguration
was a close second at 14%, and credential harvestingand DDoS attacks were also fairly common in the region.

Top attacked industries
1. Finance and insurance48%

2. Healthcare

15%

3. Energy

10%

Vulnerability exploitation led to 50% of the incidents
X-Force remediated in the Middle East and Africa where
the initial infection vector was known. Use of stolen
credentials and phishing were also frequently used togain access to Middle East and Africa networks of interest,
and password spraying and use of removable media wereoccasionally used to gain initial access as well.
Finance and insurance organizations made up theoverwhelming majority of targets in the Middle East
and Africa in 2021, accounting for 48% of all
attacks, signaling a potential shift from nation-state
sponsored energy-focused attacks in the region to
cybercriminal attacks focused on financial organizations.
Saudi Arabia’s shift to diversify its economy away fromcrude revenues may also be impacting this trend.
Healthcare organizations made up another 15% ofattacks in the region, and energy organizations wereassociated with 10% of attacks in the region.
Saudi Arabia, the United Arab Emirates, and South Africa
were the most-attacked countries in the Middle East andAfrica region.

IBM Security

40

Geographic trends

Latin America
For the purposes of reporting, IBM considers Latin America to include Mexico,Central America and South America.

Top attacked industries

The top attack type for Latin America in 2021 was ransomware,
making up 29% of attacks, followed by BEC (21%) and credential
harvesting (21%), tying for second place. REvil was the mostcommon ransomware strain observed in Latin America, making up
50% of ransomware attacks X-Force remediated, with Ryuk and
AtomSilo also being observed targeting organizations in the region.
As discussed previously in this document, the rate of BEC attacks
against Latin America is higher than for any other geography, andrepresents a sharp increase since 2019, suggesting that BEC
attackers are focusing greater attention on Latin American targets.

1. Manufacturing

22%

2. Retail and wholesale20%

3. Finance and insurance

15%

Phishing was the most common infection vector threat actors
used against Latin American targets, making up 47% of attacks
X-Force remediated in this region. The high number of BEC attacks
and ransomware attacks delivered via phishing is probably driving
this trend. Stolen credentials led to 29% of attacks on Latin
American organizations, and this high percentage comparedto other regions suggests that more widespread use of MFA
could help to drive down stolen credential and BEC incidents inthis region. Vulnerability exploitation led to only 18% of incidents
at Latin American organizations while removable media accounted
for another 6%.
Manufacturing was the most-targeted industry in Latin America
in 2021, but at 22% led by only a small margin. Retail andwholesale (20%), finance and insurance (15%), and perhaps
most surprisingly, mining (11%) followed closely behind.
Professional and business services and energy were also
fairly heavily attacked in Latin America. Ransomware attackers
and BEC attackers appear to be interested in targeting theseindustries, probably driving the attack rate for these industries
in Latin America.
Brazil, Mexico and Peru were the most-attacked countries in
Latin America.

IBM Security

41

Industry trends
For the first time in over five years of this report, finance and insurance was
not the top-attacked industry in 2021, as manufacturing overtook it by a slightmargin. The onslaught of ransomware and BEC attacks targeting manufacturingorganizations—compounding supply chain pressure created by the COVID-19
pandemic—possibly contributed to this shift.
In addition to finance and manufacturing, professional and business services was heavily targeted in 2021,
particularly by ransomware actors. This year, we are combining professional and business services as well
as retail and wholesale to provide a broader picture of the industry attack landscape. It is worth noting thatwholesale
was much more heavily attacked than retail last year, with wholesale largely driving the ranking for
Figure 21
thisindustry
We wanted
to topensureattack level
againstBreakdowngroup.
of attacks
on the10theindustries,
2021
vs.wholesale
2020 was captured in this year’s rankings.
(Source: IBM Security X-Force)
Figure 20

Breakdown of attacks on the top 10 industries, 2021 vs. 2020
(Source: IBM Security X-Force)

23.2%

Manufacturing

17.7%
22.4%

Finance andinsurance

23.0%
12.7%

Professional andbusiness services

8.7%
8.2%

Energy11.1%
7.3%

Retail andwholesale

10.2%
5.1%

Healthcare

6.6%
4.0%

Transportation

5.1%
2.8%

Government

7.9%
2.8%

Education

4.0%
2.5%

Media

5.7%
0

5%

10%
2021

IBM Security

15%

20%

25%

2020

42

Industry trends#1 | Manufacturing
Taking first place in X-Force’s ranking for the first time since 2016, manufacturing
was the top attacked industry in 2021, targeted in 23.2% of the attacks X-Force
remediated.

23.2%
of attacks

Ransomware was the top attack type, accounting for 23% of attacks on
manufacturing organizations and underscoring the heavy focus ransomware
actors placed on manufacturing. Server access attacks came in second place at
12%, representing probably some failed attacker operations. BEC and data thefttied for third place, at 10% each. BEC attackers are probably seeking to capitalizeon the many supplier, sub-supplier, and wholesale shipping relationships
manufacturing organizations develop, and attempt to redirect payments between
partners to accounts under the BEC attackers’ control. Data theft probably aims at
stealing sensitive intellectual property or holding data for ransom.
Vulnerability exploitation was the top infection vector at manufacturingorganizations in 2021, at 47%, followed closely by phishing at 40%. The volumeof these attacks probably drove the overall initial infection vector trends X-Forceobserved in 2021. Removable media (7%), stolen credentials (3%) and brute force(3%) also accounted for a small percentage of attacks. Although vulnerability
exploitation came out on top, manufacturing organizations will probably want todevote an equal amount of effort to combating phishing threats, in addition tovulnerability management.
Nearly one-third, or 32% of attacks on manufacturing organizations occurredin Asia in 2021, with North America (27%) and Europe (26%) seeing similar
percentages of attacks. Latin America (13%) and the Middle East and Africa (5%)
also saw attacks on manufacturing in their region.

IBM Security

43

Industry trends#2 | Finance and insurance
Finance and insurance organizations were in the crosshairs of 22.4% of attacks
X-Force remediated in 2021, placing it solidly in second place within X-Force’s
industry rankings. Of these attacks, 70% were on banks, 16% were on insuranceorganizations, and 14% were on other financial organizations.

22.4%
of attacks

The financial industry’s drop from first place suggests that the high security
standards in place at most financial organizations are yielding concrete results
and that the financial services industry is doing security right. In addition, hybrid
cloud environments are dominant at financial services organizations, allowing for
better visibility into and management of sensitive data.
Server access attacks narrowly emerged as the top attack type on finance andinsurance organizations in 2021, making up 14% of all attacks. This was followed
closely by ransomware, misconfigurations, and fraud, which all tied for second
place at 10%. RATs, adware and credential harvesting were also fairly common
attack types against financial services.
Phishing was the most common infection vector for financial services, leading
to 46% of attacks against this sector in 2021. Vulnerability exploitation came insecond place, leading to 31% of attacks on this sector. Password spraying, brute
force and VPN access were also observed infection vectors against finance andinsurance firms.
Asia saw a high volume of attacks on finance and insurance organizations in
2021—34% of all attacks on this industry. Finance and insurance attacks in the
Middle East and Africa were also disproportionately large, at 29%, while Europe(19%), North America (9%), and Latin America (9%) saw moderately small sharesof the attacks on finance and insurance in 2021.

IBM Security

44

Industry trends#3 | Professional and business services
Professional services include information technology providers, law firms,
architects, accountants, and specialist consultants. Business services include
firms such as office administration, human resources, security services, travel
arrangements, and landscaping. Together they form a larger services industry weare including for the 2022 X-Force Threat Intelligence Index.

12.7%
of attacks

Professional and businesses services firms were third-most attacked in our 2022
ranking, accounting for 12.7% of all attacks we observed. Of these, 24% werebusiness services firms, 76% were professional services firms, and 29% were
specifically information technology-focused professional services providers.
Ransomware was the top attack type against professional and business services
firms in 2021, making up 32% of all attacks X-Force observed on these industries.
Server access attacks were the second-most common attack type (19%), andan increase in server access attacks in Q4 2021 coinciding with a decrease inransomware attacks in Q4 suggests that professional services firms did a betterjob at identifying and stopping ransomware attackers before they met theirobjectives. Malicious insiders came in third place at 13% of all attacks on theprofessional and business services industries.
Vulnerability exploitation accounted for 50% of incidents X-Force remediatedat professional and business services firms in 2021, with phishing making
up another 20%. Use of stolen credentials accounted for another 20% of theincidents we remediated in this sector. Multiple vulnerability exploitation
incidents involved threat actors taking advantage of the Microsoft Exchange
vulnerabilities revealed early in 2021.

IBM Security

45

Industry trends#4 | Energy
Energy organizations were fourth-most attacked in this year’s rankings,
experiencing 8.2% of attacks observed and dropping from third place the year
prior. It is possible that following the blowback from the DarkSide ransomware
attack on Colonial Pipeline in May 2021, threat actors—and specificallyransomware actors—shifted their focus away from energy organizations forfear of retaliation. In 2021, X-Force observed fewer incidents against energyorganizations in all of June, July and August than in May, when Colonial Pipeline
occurred. Attacks appeared to pick back up again in September, however.

8.2%
of attacks

Ransomware (25%) was the most common attack type against energyorganizations in 2021, followed by RATs, DDoS and BEC, all of which tied forsecond place (17%). Botnets, spam and data theft also played a role againstenergy firms in 2021.
Phishing was the most common infection vector threat actors used to gain accessto energy organizations’ networks, making up around 60% of attacks, whilevulnerability exploitation made up the other 40% of incidents.
North America saw more attacks on energy organizations than any other region,
claiming 31% of all energy attacks X-Force observed last year, with Europe coming
in at 28%, Latin America and the Middle East and Africa tying for second at 17%
and Asia last with 7% of attacks on energy.

IBM Security

46

Industry trends#5 | Retail and wholesale
Retail establishments focus on the sale of finished goods directly to consumers
while wholesale organizations focus on distributing and transporting goods directlyfrom manufacturers, usually to a third party or directly to consumers. These
industries were the fifth-most targeted in X-Force’s 2022 ranking, accounting
for 7.3% of all attacks in 2021. Of these, 35% were on retail and 65% were onwholesale, underscoring the strong emphasis threat actors placed on wholesaleorganizations last year, possibly due to the critical role they play in supply chainsand movement of goods from manufacturers to end users.

7.3%
of attacks

BEC, server access, data theft, and credential harvesting were the top attack types
on retail and wholesale last year. Ransomware and banking trojans also accounted
for a high percentage of attacks, followed by RATs, misconfiguration, and fraud.
Phishing was the top infection vector for retail and wholesale in 2021, accounting
for 38% of the attacks X-Force remediated in this industry where the initialinfection vector was known. Stolen credentials came in second at 31%, andvulnerability exploitation made up another 23% of attacks on these industries.
Brute force (8%) also played a role in some attacks.
North America and Latin America tied for the highest number of incidents in theretail and wholesale industries in 2021, both claiming 35% each, and Europe wasclose behind at 31%.

IBM Security

47

Industry trends#6 | Healthcare
Healthcare emerged as sixth-most attacked in this year’s rankings, receiving
5.1% of all attacks X-Force observed in 2021 and up from seventh place theyear prior. Of attacks on healthcare where the attack type is known, 38%
were ransomware—a higher percentage than most other industries. AtomSilo,
AvosLocker and REvil ransomware actors all targeted healthcare organizations thisyear. In addition to ransomware, BEC attacks (25%) hit the healthcare industry
fairly hard this year, and server access, credential harvesting and misconfigurations
also had an effect.

5.1%
of attacks

Vulnerability exploitation was the top infection vector at healthcare organizationsin 2021, leading to 57% of the incidents X-Force remediated, followed by phishingat 29% and use of stolen credentials at 14%.
Healthcare organizations in the Middle East and Africa emerged as the most
attacked in 2021, accounting for a massive 39% of attacks on healthcare, followed
closely by North America at 33%. Asia and Latin America tied at 11% with Europe
taking only 6% of healthcare attacks.

IBM Security

48

Industry trends#7 | Transportation
The transportation industry received 4.0% of attacks, bringing it to the seventh
ranking, up from ninth place in 2020. As international borders and transportation
networks reopened in 2021, renewed activity in this industry is probably attracting
renewed attacker interest.

4.0%
of attacks

Malicious insiders emerged as the top attack type against transportation
organizations in 2021, making up 29% of attacks on this industry. Ransomware,
RATs, data theft, credential harvesting and server access attacks all played a role
against transportation in 2021 as well.
Half of all incidents X-Force remediated at transportation organizations in 2021
were initially caused by a phishing email, followed by use of stolen credentials at
33% and vulnerability exploitation at 17%.
Asia by far saw the bulk of attacks within the transportation industry, accountingfor 64% of X-Force incidents in this sector in 2021, followed by Europe (21%), theMiddle East and Africa (7%), and North America (7%).

IBM Security49

Industry trends#8 | Government
The government sector along with education tied for eighth most targetedin 2021, experiencing 2.8% of attacks. Server access attacks were the mostcommon attack type against the public sector last year, suggesting that X-Force’s
government clients in 2021 were particularly adept at identifying and eradicating
threat actors from their network before the actors moved beyond server access.
Data theft and fraud rounded out the top three attack types for government in
2021. Vulnerability exploitation was the most common infection vector usedagainst government targets, followed by phishing.

2.8%
of attacks

Government targeting was spread geographically, with half of all attacks in Asia
followed closely by North America at 30%. The Middle East and Africa (10%) andEurope (10%) saw some targeting against government organizations as well.

IBM Security

50

Industry trends#9 | Education
Education organizations received 2.8% of attacks in 2021 based on X-Force’s
research, thus tying for eighth place with the government sector. Adware was
the most common attack type observed against Education organizations in
2021, making up 33% of attacks, followed closely by ransomware at 22%. BEC,
RATs, server access attacks and fraud were also commonly seen at education
organizations last year.

2.8%
of attacks

Phishing was the top infection vector threat actors used against education,
followed by brute force attacks. Asia was the most-attacked region in terms ofincidents against education organizations in 2021, followed by North America.

IBM Security

51

Industry trends#10 | MediaMedia, which includes telecommunications, news outlets, publishers, and movie
production, accounted for 2.5% of attacks in 2021, rounding out the top 10 most
attacked industries. Ransomware was the top attack type observed against media
outlets, making up 33% of all attacks X-Force observed in this sector, followed
by server access, RAT, cryptomining, and malicious insider incidents. Brute force
and stolen credentials are the primary methods X-Force observed attackers using
to breach media organizations, suggesting that robust implementation of MFAmight insulate this sector from several attack types. Europe and Latin America saw
the largest share of attacks within the media industry, but attacks on media also
occurred in the Middle East and Africa, North America, and Asia.

IBM Security

2.5%
of attacks

52

Risk mitigation recommendations
The threats we have presented in this report have thepotential to cause concern, as the report underscores thegrave and increasing threat from ransomware, renewed
threats from BEC and phishing, and highlights several
zero-day exploits threat actors have exploited over the
past year. However, our intention is for this information
to empower organizations as they better understand thecurrent threat landscape, and help build confidence in theactions they need to take to combat these threats.
Some security principles X-Force has found helpful in combating today’s cyberthreats include a zero trust approach, automation of incident response, andextended detection and response capabilities.

Zero trust assists in decreasing riskof top attacks
Zero trust is a paradigm shift, a new way of approaching security problems, thatassumes a breach has already happened and aims to increase the difficulty for an
attacker to move throughout a network. At its core is understanding where critical
data resides and who has access to this data, and creating robust verification
measures throughout a network to ensure only the right individuals are accessingthat data in the right way.
Research by X-Force threat researchers confirms that principles related to azero trust approach—to include implementation of MFA and the principle of leastprivilege—have the potential to decrease organizations’ susceptibility to the top
attack types identified in this report, particularly ransomware and BEC.
Applying the principle of least privilege to domain controllers and domain
administrator accounts in particular can increase barriers for ransomware
actors, as many of these actors seek to deploy ransomware to a network from acompromised domain controller. In addition, implementing MFA increases thedifficulty for cybercriminals seeking to take over email accounts by requiring thatthey provide further authentication beyond stolen credentials.

IBM Security

Learn more about
how to build a zerotrust approach

53

Risk mitigation recommendations

Security automation enhances
incident response
The X-Force incident response team addresses hundreds of incidents every year,
in a variety of geographies, assisting in-house incident response analysts andaddressing a range of attack types. Speed is of the essence, whether that means
identifying and eradicating threat actors before they can deploy ransomware
on a network, or quickly and efficiently resolving issues to create bandwidth forthe next incident. In this fast-paced environment, security automation is key—outsourcing to machines tasks that might take a human analyst or team hours, andidentifying mechanisms for improving workflows.
In mid-2021, IBM donated a threat hunting automation tool to the Open
Cybersecurity Alliance, aimed at assisting security operations center (SOC)
analysts to quickly conduct forensic investigations and address cyber incidents.
In addition, the X-Force IR team uses IBM Security QRadar SOAR to enhance its
incident response capabilities.

Learn more about
IBM’s incident
response services

Extended detection and response provides
a significant advantage over attackers
Detection and response technologies—particularly when several different
solutions are combined into an extended detection and response (XDR) solution—
provide organizations with a significant advantage in identifying and eradicating
attackers from a network before they are able to reach the final stage of their
attack, such as ransomware deployment or data theft.
In multiple instances, when the X-Force IR team has deployed an endpoint
detection and response (EDR) or XDR solution on a client’s network, IR has
immediately gained additional insight that has assisted in identifying attacker
activities and quickly addressed them. XDR technologies are probably helping todrive the increase in server access and other attack types X-Force observes thatindicate an attacker was identified and stopped before the operation could achieve
its intended conclusion.

IBM Security

Learn more about
IBM Security
QRadar XDR

54

Risk mitigation recommendations

Recommendations
The following recommendations include specific actions organizations can take to better
secure their networks against the threats presented in this report.
Develop a response plan for ransomware. Every industry and every geography is at risk ofa ransomware attack, and how your team responds in the critical moment can make all thedifference in the amount of time and money lost in a response.
— Include in your response plan immediate containment actions, what stakeholders andlaw enforcement officials should be informed, how your organization will safely store
and restore from backups, and an alternate location from where critical business functions
can be run during remediation.
— Include in your plan a scenario of data theft and leak as part of the ransomware attack—this is a very common tactic used today, seen in a very high percentage of ransomware
attacks X-Force remediates.
— Use ransomware drills to also think through whether your organization would pay a ransom
and what factors would alter your calculus for that decision.
— Ensure your ransomware response plan includes a specific contingency for a cloud-related
incident, as it may require additional tools and skills.
— Avoid data corruption due to malware or ransomware attacks with flash storage solutions
that help prevent data loss, promote operational continuity, and lower infrastructure costs.
—  X-Force’s Definitive Guide to Ransomware gives additional detailed advice on how to
respond to a ransomware attack. X-Force’s incident response team can also conduct
a ransomware readiness assessment for your organization to help build and test aransomware incident response plan. The X-Force Command Center similarly preparesorganizations for a ransomware attack, taking into account both the business andtechnical response required.
Implement multifactor authentication on every remote access point into a network.
X-Force has observed more organizations implementing MFA more successfully than everbefore. This is literally altering the threat landscape, forcing threat actors to find new waysof compromising networks rather than leveraging stolen credentials, and decreasing theeffectiveness of email takeover campaigns.
— MFA can decrease the risk of several different attack types, including ransomware, data
theft, BEC, and server access.
— In addition, identity and access management technologies are making MFA
implementation easier every year—both for implementation teams and for end-users.

IBM Security

55

Risk mitigation recommendations

Adopt a layered approach to combat phishing. Unfortunately, there is no one tool orsolution that will prevent all phishing attacks today, and threat actors continue to refinesocial engineering and anti-malware detection techniques to circumvent establishedcontrols. Thus, we recommend implementing several layers of solutions that havea higher chance of catching phishing emails.
— First, effective user awareness and education is key and should include
real-world examples.
— Second, employ an email software security solution to put a machine to thetask of identifying and filtering out malicious messages.
— Third, implement several defenses that can help to catch malware orlateral movement quickly should a phishing email slip through, including
behavioral-based anti-malware detection, endpoint detection and response (EDR),
intrusion detection and prevention solutions (IDPS), and a security information andevent management (SIEM) system.
Refine and mature your vulnerability management system. Vulnerability management
is an art—from identifying which vulnerabilities are most applicable to your organization’s
network architecture, to identifying how to deploy them without breaking anything in
the process.
— Having a team dedicated to vulnerability management and making sure this teamis well-resourced and supported can make all the difference in ensuring your network
is protected from potential vulnerability exploitation.
— We recommend prioritizing any of the vulnerabilities mentioned in this assessmentthat are applicable to your organization.
—  IBM’s X-Force Exchange also includes a repository of vulnerabilities and associatedcriticality levels to assist you in identifying vulnerabilities of most concern, and
X-Force Red can provide specialized vulnerability scanning and management services.

IBM Security56

About IBM Security X-Force
IBM Security X-Force is a threat-centric team of hackers,
responders, researchers and analysts. Our portfolio
includes offensive and defensive products and services,
fueled by a 360-degree view of threats. With X-Force as
your security partner, you can affirm with confidence thatthe likelihood and impact of a data breach are minimal.
IBM Security X-Force Threat Intelligence combines IBM security operations
telemetry, research, incident response investigations, commercial data, and open
sources to aid clients in understanding emerging threats and quickly making
informed security decisions.
Additionally, the X-Force Incident Response team provides detection, response,
remediation, and preparedness services to help you minimize the impact of adata breach.
X-Force combined with the IBM Security Command Center experiences trains
your team—from analysts to the C-suite—to be ready for the realities of today’s
threats. X-Force Red, IBM Security’s team of hackers, provides offensive security
services, including penetration testing, vulnerability management and adversary
simulation.
Throughout the year, IBM X-Force researchers also provide ongoing research andanalysis in the form of blogs, white papers, webinars and podcasts, highlighting
our insight into advanced threat actors, new malware, and new attack methods.
In addition, we provide a large body of current, cutting-edge analysis to
subscription clients through our X-Force Threat Intelligence solutions.

IBM Security

Schedule a
consultation
with one of our
X-Force experts

57

About IBM Security X-Force

About IBM Security
IBM Security works with you to help protect your business with an advanced andintegrated portfolio of enterprise security products and services, infused with AI and amodern approach to your security strategy using zero trust principles—helping you thrivein the face of uncertainty. By aligning your security strategy to your business; integrating
solutions designed to protect your digital users, assets, and data; and deploying
technology to manage your defenses against growing threats, we help you to manage
and govern risk that supports today’s hybrid cloud environments.
Our new modern, open approach, the IBM Cloud Pak for Security platform, is built
on RedHat Open Shift and supports today’s hybrid multicloud environments withan extensive partner ecosystem. Cloud Pak for Security is an enterprise-readycontainerized software solution that enables you to manage the security of your data
and applications—by quickly integrating your existing security tools to generate deeper
insights into threats across hybrid cloud environments—leaving your data where it is,allowing easy orchestration and automation of your security response.
For more information, please check out www.ibm.com/security or visit the
IBM Security Intelligence blog.

IBM Security

58

Contributors

Camille Singleton

Charlotte Hammond

Vio Onut

John ZorabedianCharles DeBeckJohn Dwyer

Stephanie Carruthers

Mitch Mayne

Joshua Chung

Melissa Frydrych

Adam Laurie

Limor Kessem

Dave McMillen

Ole Villadsen

Michelle Alvarez

Ian Gallagher

Scott Craig

Richard Emerson

Salina Wuttke

Ari Eitan

Scott Moore

Guy-Vincent Jourdan

Georgia Prassinos© Copyright IBM Corporation 2022
IBM Corporation
New Orchard Road
Armonk, NY 10504
Produced in the United States of America
February 2022
IBM, the IBM logo, and ibm.com are trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other productand service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the web at “Copyright andtrademark information” at ibm.com/legal/copytrade.shtml
This document is current as of the initial date of publication and may be changed by IBM at any time. Not all offerings are available in every country
in which IBM operates. The performance data and client examples cited are presented for illustrative purposes only. Actual performance results mayvary depending on specific configurations and operating conditions.
THE INFORMATION IN THIS DOCUMENT IS PROVIDED “AS IS” WITHOUT ANY WARRANTY, EXPRESS OR IMPLIED, INCLUDING WITHOUT ANY
WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND ANY WARRANTY OR CONDITION OF NON-INFRINGEMENT.
IBM products are warranted according to the terms and conditions of the agreements under which they are provided. The client is responsible for
ensuring compliance with laws and regulations applicable to it. IBM does not provide legal advice or represent or warrant that its services or products
will ensure that the client is in compliance with any law or regulation. Statements regarding IBM’s future direction and intent are subject to change orwithdrawal without notice, and represent goals and objectives only.

IBM Security

59