People powered tech-enabled cyber security

Monthly
Threat Pulse
Review of July 2024

1ExecutiveSummary
July 2024 represented a busy monthacross the cyber security threat landscape,from ongoing ransomware attacks tomisinformation and disinformation activity.
Analysis of ransomware attacks throughout June
identified RansomHub, LockBit 3.0 and Akira as theleading threat actors.
Where targets were concerned, the Industrials,
Consumer Cyclicals and Technology sectors held thegreatest number of victims. Notably, the exploitationof a critical VMware ESXi vulnerability was exploitedby ransomware actors. This demonstrated that theexploitation of vulnerabilities remains a key tactic forransomware actors, and that organisations should
continue to prioritise patch management, as part oftheir wider threat mitigation efforts.
This month, we kickstart our focus on an exciting newtheme for Q3, misinformation, disinformation andmalinformation. In recent years we have observed
increasing efforts by threat actors to conduct
misinformation, disinformation and malinformation
campaigns, often aligned with strategic geopoliticalinterests.

This campaign was primarily observed as most active in
the United States, although also impacting Europe andAustralia alike. Sectors of interest included Healthcare
and Telecommunications, alongside several others.
No detections were made by NCC Group’s MXDR teamfor DarkGate malware across any of our clients SIEM,
network detection, and EDR solutions.
Finally, our spotlight this month provides exciting
insights into the evolving tactics, techniques andprocedures (TTPs) of ransomware actors. Specifically,
we look at the ever-increasing use of information
stealer malware by ransomware actors.
The research underscores how threat actors arecontinuously identifying new methods to bolster thesophistication of their attacks and seek to gain profit
via illicit means.
Likewise, it serves as a reminder that effective
cybersecurity demands multiple solutions, regularly
updated and informed by actionable threat intelligence.

Contents
SECTION 1

Ransomware Insights.......................... 4

SECTION 2

Misinformation, Disinformation andMalinformation: 2024 Global Elections
and the Olympic Games....................... 6
SECTION 3
July’s Threat Hunt: DarkGate Remote
Access Trojan......................................... 8

SECTION 4Threat Spotlight:
Infostealer and Ransomware Blog....10

This year, there are several global events which havebeen targeted, such as the global elections and theOlympic Games. The events stress the pressuressociety operates under to preserve and protect thetruth, as threat actors seek to manipulate public
opinion for their own strategic advantages.
NCC Groups monthly investigation into new prolificthreats investigated the DarkGate Remote AccessTrojan (RAT) and associated campaign, which ran fromMarch 2024.

23Section 1

Ransomware
Insights
Figure 1: Global Ransomware Attacks by Month 2023 - 2024

From June to July 2024, the ransomware
landscape observed a 20% increase inattacks from 329 in June to 395 in July.
This increase could be attributed to the summer
holiday period, during which time threat actors may
seek to exploit the decrease in employees present atwork, including in IT security and support departments.
Attacks during the holiday period can catch companies
off guard, which may result in longer investigation
times, damage, and recovery times.

The July numbers overall however remain much lower
than observed between February – May, the mostactive period of 2024 thus far, and suggests an overall
decline in ransomware activity at present. Whether thisincrease reflects the start of an upward trend remains
to be seen, and we will continue to monitor suchactivity.
The Industrials sector saw the greatest number ofattacks, 125, up from 105 in June, and reflects acontinued interest by threat actors in targeting criticalnational infrastructure (CNI). Organisations within
CNI provide critical services to society making themvaluable targets, and ransomware actors pressure
these targets into payment, exploiting their need toremain operational.
RansomHub emerged as the most active threat actor
this month with 43 attacks, up from 27 in June. Thisaccounted for 11% of all activity for the month andreflects a continued hold on the threat landscape by
the group. RansomHub operates a ransomware-asa-service model (RaaS), which will contribute to thehigher numbers we observe, with wider affiliates also
employing the ransomware strain to conduct attacks.

4For those organisations that feel they could
benefit from in-depth ransomware insights,
which is a threat that has only continued
to significantly rise in prevalence andsophistication over the past few years, wepoint you towards our Threat Intelligence
Subscription Service.
This package gives clients access to ourPremium Threat Pulses, Threat Monitor
Reports, and Threat Intelligence Alerts –reported within 24 hours - for significant
vulnerabilities and cyber campaigns.
For Ransomware Insights specifically, weelaborate on the most targeted sectors
and regions, as well as the most active
ransomware groups so organisations canproactively enhance their security posture
based on the threat to their specific areas ofoperation.

5Section 2

Misinformation,Disinformation andMalinformation:
2024 Global
Elections and theOlympic Games

Misinformation, Disinformationand Malinformation
In Q3, we will be covering the themesof misinformation, disinformationand malinformation. Misinformation,
disinformation, and malinformation
are three types of false or misleading
information that can have harmful effects
on individuals, groups, organisations, andcountries.
This month, we consider how campaigns can impact
large scale events, such as the 2024 Olympics andglobal elections.
Recent events, including the attempted assassinationof Presidential candidate Donald Trump, and thecontroversy surrounding Olympic athlete Imane
Khalif, have brought to the forefront the impact ofdisinformation on discourse.

Developments in artificial intelligence (AI) have helped
drive improvements in the output of malicious actors,increasing the plausibility and persuasiveness ofmisinformation and disinformation.
Information manipulation is not new however, with theadvent and proliferation of social media, messages areeasily amplified and disseminated at scale.
In addition, social media is increasingly consumed by adiverse audience of all ages, with information reachinga much broader cross section of the population.
Combining large scale reach through digital channels
with the advances in AI, lowers the barrier to entry
for making credible content and can have increased
influence.
As such, threat actors have the potential to createand disseminate false information to audiences moreeasily. For those wishing to influence current largescale events, such as elections and the 2024 Paris
Olympics, this provides ample opportunity.

The full version of Intelligence Insights iscovered in our Premium Threat Pulse.
This is available to Managed Service clientsand those that purchase our Intelligence
Subscription Service.
NCC Group offer Threat Intelligence services
including that of bespoke reporting on topics
surrounding your organisation.
Why not speak to a member of the team tosee how we can support your business withthe ever-evolving threat landscape.

67SummarySection 3

July’s Threat
Hunt: DarkGate
Remote AccessTrojanOn a monthly basis, NCC Group’s ThreatIntelligence Team researches and identifies
prolific threats across the threat landscape.
These vary from new infostealer malware towidespread campaigns conducted by nationstates or Organised Crime Groups (OCGs)
and support our threat hunts on our SOC
customer’s infrastructure.
This allows us to leverage IoC-driven threat intelligenceto fuel proactive detection on our customer’s
environments and subsequently remediate the threat.
These IoC’s are queried against our Endpoint Detection
and Response (EDR), Security Information and EventManagement (SIEM) and Network Monitoring clients,
and in July, our focus was a DarkGate Remote AccessTrojan (RAT) targeting multiple sectors around theglobe

The Results
No detections were made by NCC Group’s SOC teamfor DarkGate malware across any of our SIEMs,network, or EDR solutions. Ongoing monitoring ofour clients’ estates is a key part of helping to maintainstrong security postures and ensure a swift response to
any emerging threat.
For any queries about how our SOC, Threat Intelligence,or Online exposure Monitoring (OXM) services can help
you, please contact your Account Manager/ServiceDelivery Manager who can assist you.

8The full insights provided by our Threat Huntare covered in our Premium Threat Pulse.
This is available to Managed Service clientsand those that purchase our Intelligence
Subscription Service.
Our Threat Hunt capabilities are available
through our Managed Services offerings
including MDR, MXDR and XDR SOC services.

Get in touch with our teams
to give your organisation thereassurance and insights provided
by our proactive intelligence-led
security services.

9Section 4

Threat Spotlight:
Infostealer andRansomware
Blog

Is the apparent rise in infostealer
malware usage among
cybercriminals reflected in theransomware landscape too?
Infostealers have been making headlines
due to their role in harvesting valid
corporate credentials, leading to significant
data breaches.
The recent CrowdStrike incident, involving a content
configuration update for the Falcon Sensor in Windows,
which led to global IT outages, was exploited by threat
actors using a false recovery repair manual to lurevictims to install information stealing malware.

The use of infostealers has increased recently, this is
unsurprising given that they reduce the burden on
criminals wishing to gain access to organisations andtheir networks.
It is far easier, faster, and often cheaper, to use stolen
valid credentials to access a network, than it is to findusable exploits and leverage these for initial access.
With the threat of ransomware continuing to dominate
the cyber threat landscape, has the rise in the useof infostealers impacted how ransomware groups
operate?

The full Threat Spotlight can be viewed in
our Premium Threat Pulse.
This is available to Managed Service clientsand those that purchase our Intelligence
Subscription Service.

If you are interested in key
insights and explorations of thecurrent threat and geopoliticallandscape, look no further thanour monthly Threat Spotlights.
These will provide you with an in-depth viewof current pertinent topics from AI, risingmalware, emerging threat actors,
nation-state activities and more.

1011

About us
NCC Group is a global cyber and software resiliencebusiness, operating across multiple sectors,
geogra-phies and technologies.
As society’s dependence on the connected environment
and associated technologies increases, we use ourglobal expertise to enable organisations to assess,develop and manage their cyber resilience posture toconfidently take advantage of the opportunities thatsustain their business growth.
With circa 2,400 colleagues, we have a significant
market presence in the UK, Europe and North America,
and a growing footprint in Asia Pacific with offices inAustralia, Japan and Singapore.

+44 (0)161 209 5200
reponse@nccgroup.com
www.nccgroup.com

1213

People powered tech-enabled cyber security

Interested in our
premium reports?
Click here14