Incident Response

Each year, CrowdStrike releases its Threat Hunting Report to provide insights into adversary tactics, highlight notable breaches and provide recommendations on how to better protect your business. In last year’s report, key findings clearly focused on the rising cyber threats in response to the COVID-19 crisis. However, a year on, with work-from-home practices firmly in place, there has been little reprieve from escalating threats. In fact, the past year has laid witness to some of the most serious and widespread cyber attacks yet.

During the 2020-21 financial year, Australia's economy has been hugely influenced by the COVID-19 pandemic. The dependence of individuals and organisations on the internet has risen rapidly in response to the need to work from home, access services and information remotely, and communicate with others at a distance. However, this increase in online engagement has increased the attack surface and created new opportunities for malicious cyber actors to exploit vulnerable targets.

Phishing attacks have increased dramatically over the last few years, with the global pandemic escalating the situation further. Cybercriminals take advantage of insecurities and fear and play on human nature to trick and deceive. In fact, according to the OAIC, phishing attacks that involved compromised credentials accounted for 30% of all cyber incidents in the first half of 2021. And human error formed a major source of these breaches. Unfortunately, due to the clever social engineering tactics used by cybercriminals, technical filters alone aren’t sufficient to protect against phishing.

Email attacks have always been a threat to businesses since their inception, but over the last decade they have exponentially evolved in sophistication and frequency. Instead of using detectable malware, links and attachments, they use social engineering to impersonate trusted sources. These extremely believable impersonations have led to a surge in account takeovers. And it all happens very quickly, with half of compromised accounts accessed within 12 hours of an attack. Unfortunately, the ongoing COVID-19 pandemic has added fuel to the fire.

You are most likely aware of Business Email Compromise (BEC), but are you familiar with its younger sibling, Vendor Email Compromise (VEC)? This term first started circulating in the industry towards the end of 2019 and describes an attack style whereby a cybercriminal takes over the account of one of your suppliers. However, the cyber attackers target isn’t the supplier, it’s you. By disguising as a trusted entity outside of your organisation, they can easily convince your employees to disclose sensitive information or pay fake invoices.

Nowadays, we can increasingly see press releases after cyberattacks that say that “it was a sophisticated attack, behind which there were statesmen,” which means that the attackers acted in the interests of one or more states. Along with Chinese and North Korean hackers, hackers supporting the Russian government are very often accused of attacks. Of course, we are not here to make blind accusations, so let’s look at a potential example where digital traces lead to Russian hackers.