Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

3/1/2021
05:20 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Cynet Reviews the Top 6 Most Notable Cyber Attacks of 2020

2020 cyber pandemic wreaks havoc on organizations of every size.

New York, NY – February 23, 2021 -- Cynet (http://www.cynet.com) today turned back the pages of 2020 to review the most noteworthy cyberattacks making up the cyber-pandemic, which came with COVID-19 and the flight of employees to remote work environments. These cyber events were part of an ongoing series of attacks, keeping IT security professionals on high alert.

2020 was the year that COVID-19 brought a major cyber-pandemic to the world. An assessment by INTERPOL revealed that organizations and businesses rapidly deploying remote systems and networks to support staff working from home were being taken advantage of by cybercriminals. The report noted that in a four-month period, "some 907,000 spam messages, 737 incidents related to malware and 48,000 malicious URLs – all related to COVID-19 – were detected by INTERPOL and its private sector partners." Many of these never made the headlines, but six major attacks did – ranked below by their overall impact.

1. The SolarWinds Attack - This attack involved hackers compromising the infrastructure of SolarWinds, a company that produces a network and application monitoring platform called Orion, and then using that access to produce and distribute trojanized updates to the software's users.
2. FireEye: The Stolen Red Team Tools - On August 12, 2020 FireEye announced that a sophisticated group of hackers, likely state-sponsored, broke into its network and stole tools that the company's experts developed to simulate real attackers and test the security of its customers. The attack was later found to be tied to SUNBURST malware which was also responsible for the SolarWinds attack.
3. Software AG: Clop Ransomware Attack - The second-largest software vendor in Germany was reportedly hit by a ransomware attack in October 2020. News outlets reported that the German tech firm had been attacked by the Clop ransomware and that the cyber-criminal gang had demanded a $23 million ransom.
4. Sopra Steria: Ryuk Ransomware Attack – The 46,000 employee European information technology firm announced on October 21, 2020 that it had detected a cyber attack the previous evening. The virus was identified as a new version of the Ryuk ransomware, previously unknown to antivirus software providers and security agencies. The attack followed a previous infection with either TrickBot or BazarLoader.
5. Telegram Hijack – Hackers with access to the Signaling System 7 (SS7) used for connecting mobile networks across the world were able to gain access to Telegram messenger and email data of high-profile individuals in the cryptocurrency business. In what is believed to be a targeted attack, the hackers were after two-factor authentication (2FA) login codes delivered over the short messaging system of the victim’s mobile phone provider.
6. BlackBaud: Ransomware Attack - Blackbaud, a cloud technology company, was hit by a data-stealing ransomware attack earlier this year. The attack was one of the biggest of the year in terms of the number of organizations affected, with nearly 200 organizations and millions of individuals potentially impacted.

Lessons Learned
The most common causes of data breaches are weak or stolen credentials, back doors/vulnerabilities, malware, social engineering, excessive permissions, insider threats and improper configuration/user error, so businesses need to be diligent. Cybersecurity needs to be top of mind and systems and setups need to be routinely assessed. Any organization can become the victim of phishing schemes, ransomware, DDoS, malware, and other attacks leading to data breaches. Stress to customers that taking all necessary precautions is the best chance they have at staying secure. Along with detection and response tools, authentication protocols and ongoing employee security awareness training can make the biggest difference.

"Because the reality is challenging and the future is not promising to be better in terms of cybersecurity threats and malicious attacks, cybersecurity pros must be prepared in the defense of their organization," said Eyal Gruner, CEO and founder of Cynet. "Going deeper into 2021, Cynet stands ready to support organizations and address these challenges to improve overall security readiness with next-generation XDR (EPP, NGAV, EDR, NDR, UBA), SOAR and advanced MDR services in a single platform."

Tweet this: @Cynet Reviews the Top 6 Most Notable Cyber Attacks of 2020 - https://bit.ly/2UgxHCE

Resources
To learn more about Cynet:
• Discover the complete survey on the Cynet blog at:
https://www.cynet.com/blog/2021-survey-CISOs-with-small-security-teams
• Register for a webinar on the new SME CISO Survey results at:
https://cynet.easywebinar.live/survey-CISOs-with-small-security-teams
• Visit Cynet at https://cynet.com
• Follow Cynet on Twitter at http://www.twitter.com/cynet360
• Follow Cynet on LinkedIn at https://www.linkedin.com/company/cynet-security/

About Cynet
Cynet 360 is the world's first Autonomous Breach Protection platform that natively integrates XDR endpoint, user and network attack prevention and detection capabilities with an incident engine that fully automates investigation and remediation actions, backed by a 24/7 world-class MDR service. End to end, fully automated breach protection is now within reach of any organization, regardless of security team size and skill level. For additional information, please visit: https://www.cynet.com.

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
News
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Commentary
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-16632
PUBLISHED: 2021-05-15
A XSS Vulnerability in /uploads/dede/action_search.php in DedeCMS V5.7 SP2 allows an authenticated user to execute remote arbitrary code via the keyword parameter.
CVE-2021-32073
PUBLISHED: 2021-05-15
DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a remote attacker to send a malicious request to to the web manager allowing remote code execution.
CVE-2021-33033
PUBLISHED: 2021-05-14
The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value.
CVE-2021-33034
PUBLISHED: 2021-05-14
In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value.
CVE-2019-25044
PUBLISHED: 2021-05-14
The block subsystem in the Linux kernel before 5.2 has a use-after-free that can lead to arbitrary code execution in the kernel context and privilege escalation, aka CID-c3e2219216c9. This is related to blk_mq_free_rqs and blk_cleanup_queue.