Q4 2022 Threat Landscape Report: Tech and Manufacturing Targeted as Ransomware Peaks for 2022

Q4 2022 Threat
Landscape Report:
Tech and Manufacturing Targetedas Ransomware Peaks for 20221

Q4 2022 Threat Landscape Report: Tech and Manufacturing Targeted as Ransomware Peaks for 2022

Q4 2022 Threat Landscape Report:
Tech and Manufacturing Targetedas Ransomware Peaks for 2022
Authors

Laurie Iacono

Keith Wojcieszek

George Glass

In a year where headlines were dominated by the global economic and geopoliticaluncertainty around Russia’s war on Ukraine, 2022 saw a threat landscape that was bothvolatile and fragmented, largely due to the war. As the year drew to an end, ransomware
hit a peak, primarily due to the rise in attacks impacting the manufacturing, health care,technology and telecommunications industries. This came after a dip in ransomware
during the third quarter of 2022, suspected to be due to the disbandment of the Conti
ransomware group.
Kroll’s research found that several other familiar threats remained highly active throughout
2022, such as a significant increase in phishing and a notable rise in unauthorized access,increasing from 18% of cases in 2021 to 25% in 2022. Notable new initial access methods
included an infection method leveraging Google Ads to spread credential-stealing
malware and a rise in the use of USB-borne malware as a means to spread infection
throughout a network.

2

Q4 2022 Threat Landscape Report: Tech and Manufacturing Targeted as Ransomware Peaks for 2022

Q4 2022 Threat Timeline
Oct 4

New ProxyNotShell exploit emerges: ProxyNotShell becomes a new exploit,
taking advantage of two vulnerabilities (CVE-2022-41040 and CVE-202241082), which gives an attacker visibility of emails on an organization’s server
and grants them the ability to plant malware on an Exchange server. Microsoft
issued mitigation steps to address the vulnerabilities before issuing a patch in
the November 8 Patch Tuesday Updates.

Oct 7

Rclone used in Microsoft 365 to execute email compromise attacks:
Kroll observes the data syncing tool Rclone being used in M365 for network
compromises or phishing attacks. Rclone is seen being used to downloada large number of files on SharePoint/OneDrive from a Microsoft 365 accountin only a little over an hour.

Nov 19Google Ads used to distribute Royal ransomware: Microsoft warns about
threat actors using Google Ads to distribute post-compromise payloads,
including Royal ransomware.

Nov 24

Qakbot malware used to infiltrate U.S. companies: The Black Basta
ransomware group is found to be using aggressive QakBot malware
campaigns that lead to ransomware infections on compromised networks.

Dec 5

New tactics associated with AvosLocker ransomware: Threat actors
associated with the ransomware target Veeam Backup and Replication
systems for possible exfiltration. (CVE-2022-26500 and CVE-2022-26501).

3

Q4 2022 Threat Landscape Report: Tech and Manufacturing Targeted as Ransomware Peaks for 2022

Sector Analysis: Tech and Manufacturing Caught in the Crosshairs
In 2022, the top five impacted sectors across Kroll incident response cases were: professional
services, health care, financial services, manufacturing, and technology and telecommunications.

Top Five Impacted Sectors 2022 vs 2021 (All Threat Incident Types)
17%

Professional Services

16%
12%

Health care

13%
12%

Financial Services

12%
10%

Manufacturing

12%
9%Technology &Telecommunications

10%

2021

2022

While the professional services sector has typically been the top targeted sector for Kroll cases,in 2022, Kroll observed a slight decline in those attacks, while other sectors were targeted more,
namely manufacturing and technology and telecommunications.
This differs from the industry spread of data breaches Kroll saw in 2022. In Kroll’s Data Breach
Outlook report, health care overtook finance as the most breached industry of the year,
accounting for 22% of all breaches, compared to 16% in 2021. Delving further into this data,
Kroll received most engagement from consumers whose data had been breached in thefinancial services sector, and this concern seems to be increasing as call volumes increased
127% year on year in 2022.

4Q4 2022 Threat Landscape Report: Tech and Manufacturing Targeted as Ransomware Peaks for 2022

Percentage of Ransomware Incidents Across the Five Most Impacted Sectors in 2022
6%

Education

7%
8%

Technology &Telecommunications

9%
19%

Professional Services

13%
11%

Health care

13%
14%

Manufacturing

21%

2021

2022

Ransomware was evident in the majority of attacks impacting manufacturing, health care, technologyand telecommunications. Its prevalence in these sectors spiked in the fourth quarter.

Quarter-Over-Quarter Increase in Ransomware Attacks in Q4 2022
15%13%

12%12%9%
5%

Manufacturing

Health care

Q3 2022

Technology &Telecommunications

Q4 2022

There were some other notable cases Kroll observed in the manufacturing, technology andtelecommunications industries that point to wider trends.

5Q4 2022 Threat Landscape Report: Tech and Manufacturing Targeted as Ransomware Peaks for 2022

Case Study: The Technology and Telecommunications
Industry Becomes a Route to Managed Service Providers
In the technology industry, Kroll has seen many attacks on managed service providers(MSPs). In one case, threat actors had set up Google Ads for the search term “commonIT management software.” This software is widely used by MSPs, and it is likely that
IT administrators and MSPs were the target of these adverts. The ads provided thelegitimate software packaged with a Batloader installer that, when executed, provided
a backdoor with elevated privileges to the network. This then allowed the threat actor
to quickly scout the internal network for sensitive files and high-value systems before
disabling security software.
The threat actor traversed several file servers and extracted data from each before
exfiltrating the data to cloud data storage via Rclone. Once the exfiltration wascompleted, the Black Basta ransomware binary was executed. The impact of thisactivity had many complications as data was removed, which may have containedclient data, as well as the encryption of vital servers, likely affected the MSP’s daily
operations to its clients, thus increasing the pressure to pay the ransom.

“FPOMSPs are a prime target for cybercriminals,” says
Vice President at Kroll, Stephen Green. “The nature of
an MSP’s business means that the demands of the supply
chain will often provide greater pressure to pay anyransom. The access granted to an MSP also provides
opportunities to conduct further attacks against its clientsfor additional payments. This may be a reason Kroll has
observed threat activity increasingly targeting thetechnology sector and is supported by a number ofindustry warnings about supply chain risk, includingfrom the Five Eyes (FVEY) intelligence alliance andthe UK’s National Cyber Security Centre (NCSC).
— Stephen Green, Vice President,
Cyber Risk, Kroll6”

Q4 2022 Threat Landscape Report: Tech and Manufacturing Targeted as Ransomware Peaks for 2022

Case Study: Cybercriminals Tap into BusinessContinuity Concerns in the Manufacturing Sector
In a representative incident in the manufacturing sector, Kroll observed the deploymentof Vice Society ransomware. Initial access was obtained through a botnet infection that
helped attackers conduct an initial exploration of the network. Once the attackers had
gained a foothold in the system, they maintained persistence using a variety of remote
access tools. After moving into a domain admin account, they exfiltrated hundreds ofgigabytes of data for a series of days and then encrypted the network. The attackers
locked IT staff out of the company’s systems. This meant that all critical operating
systems, including production, were halted.

50%“annual increase in ransomware cases targetting
the manufacturing sector in 2022

The manufacturing sector is an attractive target for
ransomware gangs due to the level of businessdisruption it can cause,” says Kroll Managing Director,Walmir Freitas. “Often these sectors hadn’t typicallyseen themselves as targets for cybercriminals because
they held limited sensitive information. But the growth
in ransomware has changed the game; manufacturingorganizations may be more willing to pay a ransom
when their ability to operate is hanging in the balance.
— Walmir Freitas, Managing Director,
Cyber Risk, Kroll”
7

Q4 2022 Threat Landscape Report: Tech and Manufacturing Targeted as Ransomware Peaks for 2022

Most Common Cyber Threats of 2022 vs. 2021
Year-on-Year Comparison: Most Common Threat Incident Types in 2021 and 2022
42%

Email Compromise

33%
33%

Ransomware

32%
18%

Unauthorized Access

Web Compromise

25%
4%
6%

2021

2022

Several notable trends shone through in our analysis:• Email compromise saw a decline from its 42% peak in 2021, likely due to widespread patchingfor the Microsoft Exchange ProxyLogon vulnerabilities that threat actors continued to attempt
to use to exploit email servers in 2022.
• Unauthorized access saw a large year-over-year increase in 2022. As discussed in the Q3
Threat Landscape report, insider threat accounted for the majority of this activity in 2022.
• Although the total number of ransomware incidents in 2022 decreased slightly from 2021,
ransomware still accounted for nearly a third of Kroll incident response cases.

Percentage of Ransomware Incidents in Kroll Cases Throughout 2022
32%

34%

33%
25%

Q1 2022

8Q2 2022

Q3 2022

Q4 2022

Q4 2022 Threat Landscape Report: Tech and Manufacturing Targeted as Ransomware Peaks for 2022

Ransomware Analysis: 2022 – A Year of Regrouping, with Rising
Activity in Q4
Ransomware continues to be a top threat impacting organizations, and during the past year,
Kroll has seen many ransomware groups evolve their tactics to reach more victims.

Most Common Ransomware Variants – 2022 to 2021 Comparison
33%
29%

11%

9%

7%
1%
LockBitConti

Phobos

9%

2%
Hive
2021

9%

0%

8%
2%

Black Basta AvosLocker
2022

7%

6%

1%

0%

Blackcat/APHLVRoyal

As security controls got better at stopping certain ransomware attacks, affiliates were forced toswitch to different variants during the same access period. This observation highlights that
affiliates distributing ransomware are often doing so on behalf of more than one cybercriminalgroup. In 2022, Kroll observed increased activity from familiar groups such as Hive, AvosLockerand Vice Society. After Conti disbanded in June 2022, LockBit became the most commonly
observed ransomware across Kroll engagements. Other newcomers such as BlackBasta andRoyal were also active during the year.
Although the group associated with Royal ransomware has been active since January 2022,
Kroll first observed a case in November 2022, and in Q4, Royal ransomware accounted fornearly 14% of ransomware activity. Royal appears to be a collective of threat actors from otherwell-known malware groups such as Roy/Zeon, Conti and TrickBot, working together as a
private ransomware group. Royal ransomware has been connected with many different initialaccess techniques, including callback phishing attacks, brokered access and Google Ads abuse.
Other variants that Kroll observed on the rise in Q4 were Phobos, Dharma and AvosLocker.

9Q4 2022 Threat Landscape Report: Tech and Manufacturing Targeted as Ransomware Peaks for 2022

Top Initial Access Methods in 2022
Year-on-Year Comparison: Most Common Initial Access Methods in 2021 and 2022
26%Phishing

52%
44%

CVE or Zero-Day
Explotation
External RemoteServices

Valid Accounts

16%
4%
14%
5%
8%

2021

2022

2022 saw a significant shift in the top initial access methods for threat actors. While CVEs andzero-day exploitations were responsible for 44% of initial access methods in 2021, phishing
was responsible for 52% in 2022. In 2021, a high percentage of Kroll’s email compromise cases
were associated with the Exchange ProxyLogon CVE and a significant volume of exploitedvulnerabilities.
In Q4, Kroll noted another rise in the use of external remote services, which continues to be afavorite access method for ransomware groups. Kroll also reported on a novel access method
leveraging Google Ads to infect users with credential-stealing malware such as VIDAR.
Beyond VIDAR, which has been around since at least 2018 and has benefitted from several
improvements over the years, the increase of SocGholish usage for initial access in 2022 isworth highlighting. SocGholish is commonly delivered via search engine optimization hijacking,ad impersonation and drive-by-download. In 2022, SocGholish worked with cybercriminal
partners to increase its infection efficacy by increasing the number of websites serving
malware and the reputation of the sites that redirect to them, helping to improve their searchengine rankings. Defenders should treat detections of either VIDAR or SocGholish as a highseverity threat.

2022 Into 2023: Turbulence Continues
Activity observed by Kroll in Q4 aligned with the trend that defined 2022 as a whole: not only
have many familiar threats not gone away, but they continue to evolve and adapt. This wasevidenced by the prominence of ransomware throughout 2022, hitting health care in Q2, theneducation in Q3, before a significant spike in focus on technology and manufacturing in Q4.
10

Q4 2022 Threat Landscape Report: Tech and Manufacturing Targeted as Ransomware Peaks for 2022

While the specific types of threats may not have changed much from 2021 to 2022, the central
story of 2022 is cybercriminals’ ability to quickly evolve and regroup in the face of advancing
security controls, law enforcement activity and geopolitical disruption. The near-seamless transition
from Office maldocs to container files in phishing attacks and new access tactics like Google Ads
abuse illustrate the constant evolution of techniques to which organizations must pay attention inorder to improve their defenses. However, they also need to ensure they are prepared to meet thechallenges presented by newly emerging threats.

The Year Ahead: Threats Likely to Evolve in Form and Focus
As threat actor activity is often shaped by fluctuations in economic conditions, there is little doubtthat the variability of behaviors observed in 2022 will endure in 2023. Due to the continued market
volatility across the globe and the ongoing war on Ukraine, it is likely that the unstable circumstancesin which attackers thrive will persist in 2023. The continued democratization of cybercrime throughtechnology such as ChatGPT could also drive further developments in threat activity.
2023 is likely to see threat actors honing their tactics to move faster and more nimbly, with more
techniques to circumvent defense tools. This makes swift detection of suspicious activity even morecritical for organizations. As suggested by activity observed in Q4, it is also highly probable thatransomware will continue to evolve in complexity and impact in the year ahead.
With the value of cryptocurrency going down and the average ransomware profits declining in
2022, 2023 could well see ransomware-as-a-service groups looking to maximize their revenue
streams and ransomware actors as a whole becoming more destructive.
Following on from the technology sector being a major target of ransomware in Q4 2022, large
IT providers are likely to be a target in 2023, as threat actors attempt to use them as a route tocompromise end clients via supply chain attacks. An increase in attacks against Operational
Technology (OT) environments is also highly probable, as is the use of techniques similar to
those used in 2022.

Key Steps to Stay Resilient in a Volatile Security LandscapeWith so many sectors targeted by attackers throughout 2022,
no industry or market segment can afford to be complacent as it relates
to ongoing monitoring of their internal infrastructure. Actionable threat
intelligence and a robust managed detection and response program willplay a vital role in enabling businesses to respond effectively to themany and varied threats likely to arise in 2023. Apart from working
with trusted partners to achieve this, businesses can implement specificchanges themselves. These include enforcing multi-factor
authentication, using remote desktop protocol (RDP), creating multiple
backups and having effective access control. By taking proactive steps
now, organizations can ensure they are better prepared to respond to
the global headwinds likely in 2023 and beyond.

To learn more, view theKroll guide, 10 Essential
Cybersecurity Controls forIncreased Resilience.

11Browse the latest editions of Kroll’s Quarterly Threat Landscapereports and subscribe for free at kroll.com/cyberblog
About KrollAs the leading independent provider of risk and financial advisory solutions, Kroll leverages our unique insights, data and technology to help clients stay ahead of complex
demands. Kroll’s global team continues the firm’s nearly 100-year history of trusted expertise spanning risk, governance, transactions and valuation. Our advanced solutions
and intelligence provide clients the foresight they need to create an enduring competitive advantage. At Kroll, our values define who we are and how we partner with clientsand communities. Learn more at Kroll.com.
M&A advisory, capital raising and secondary market advisory services in the United States are provided by Kroll Securities, LLC (member FINRA/SIPC). M&A advisory,
capital raising and secondary market advisory services in the United Kingdom are provided by Kroll Securities Ltd., which is authorized and regulated by the Financial
Conduct Authority (FCA). Valuation Advisory Services in India are provided by Kroll Advisory Private Limited (formerly, Duff & Phelps India Private Limited), undera category 1 merchant banker license issued by the Securities and Exchange Board of India.
© 2023 Kroll, LLC. All rights reserved. KR23010178