Industry executives and experts share their predictions for 2022. Read them in this 14th annual VMblog.com series exclusive.
2022 Security Predictions: Cyberattack Edition
By Alex “Jay” Balan, Security Research Director at Bitdefender
This year has come to an end and the cybersecurity community is working hard on technologies and solutions that will help protect consumers and businesses in 2022 and beyond as malware, social engineering and other threats to IT environments rapidly evolve.
Bitdefender Labs and its Managed Detection and Response team are renowned for their keen insights on how cybercriminals and nation-state adversaries continuously adopt new tactics and techniques to breach defenses. The following are three of their cybersecurity predictions for 2022.
1. Ransomware will continue to dominate the threat landscape
Unfortunately, our prediction for increased ransomware activity in 2021 came true. 2021 was extremely active for ransomware. Solar Winds, The Colonial Pipeline, Kaseya, and Brenntag are just some of the big names involved in ransomware attacks that the US Treasury tied to $5.2 billion worth of payments during 2021 alone.
Ransomware will continue to be the most lucrative type of cyber-crime in 2022. We expect to see an increase in Ransomware-as-a-Service (RaaS) attacks that will focus on data exfiltration for blackmailing purposes. Just like any mature business, ransomware will have to keep up with both competition and cyber-security vendors alike.
We also expect a boost in ransomware for Linux environments that target ESXi storage or templates. ‘Silent ransomware’ – malware that stays dormant for periods of time before encrypting data – will likely be used in more attacks. The Java Log4j vulnerability, which recently shook up the cybersecurity community because of its pervasiveness and ease of exploit, created a perfect storm for ransomware. We expect to see fallout from Log4j in the coming months and for potentially years to come. Jen Easterly, head of the Cybersecurity and Infrastructure Security Agency (CISA), called it “the most serious flaw” she has seen in her decades-long career.
Overall, ransomware as a service will undergo reorganization to focus on becoming more resilient, going into the realm of zero-day exploits for maximized reach.
2. State-sponsored attacks will leave communities in the dark
Political tensions will likely have a great impact on the cyber-realm, as nation-states race for digital supremacy. 2022 will likely be the year of cyber-attacks against critical infrastructure. “Killware” could be the weapon of choice, since it can be deployed using similar tactics as classic APTs, and is effective against power grids, water and sewage plants or public transportation with immediate impact on communities and societies. It’s not just public utilities, but also chunks of the internet that attackers might want to disrupt in 2022.
DDoS attacks and hijacking of the Border Gateway Protocol (BGP) will soar, causing massive disruption to digital economies and telecommunication. We will potentially see “hack-back” initiatives around the world, especially against nation-states that provide cyber-criminals safe harbor for digital crimes targeting US or European institutions.
3. Supply chain attacks and zero-day markets will rise
Among the lessons learned in 2021, supply chain attacks targeting Managed Service Providers (MSPs) were the hardest to mitigate. In contrast to other threats, supply chain attacks are more silent, more difficult to stop and propagate at a faster pace. In 2022, professional cybercrime groups will focus attention on breaching MSPs to deliver ransomware to larger pools of potential victims. As cyber-security vendors started to address the documented MiTRE techniques, cyber-criminals will focus their research on the discovery and implementation of new techniques for implementing MiTRE/Kill-chain tactics. We expect to see new attack avenues leveraging COM/WMI, as these are insufficiently monitored by existing endpoint detection and response (EDR) technologies.
Public open-source code repositories such as Pypi or NPM will also gain unwanted attention from cyber-criminal groups looking to sneak malicious code into products or infrastructure for supply chain attack purposes.
On top of supply chain attacks, we also expect to see an increase in usage of zero-day exploits in certain targeted attacks. In 2021, we saw an increase in zero-day vulnerabilities in all major technology stacks – Chrome, Exchange, Office, Windows 10, iOS – and the future does not look any better. Tianfu Cup, the Chinese version of Pwn2Own, was a clear display of the capabilities available to other non-English speaking countries.
But there are more than zero-day vulnerabilities that will allow cyber-criminals to cause widespread damage to businesses. Tools such as CobaltStrike will become increasingly adopted by malware operators. Cyber-criminals find inspiration inside the community – if one cyber-crime group rises to fame by employing existing tools, the rest of the community will follow suit. Emotet malware is a prime example of such behavior, as it is on the rise again and successfully uses CobaltStrike beacons to expedite the installation of ransomware in corporate networks.
As we’re laying these predictions in writing, the cybersecurity industry is keeping pace with the evolving threat landscape working on security solutions to protect our digital society. Here’s to a successful 2022 keeping your systems and data safe from cybercrime.
##
ABOUT THE AUTHOR
Alex Balan is the Security Research Director at Bitdefender. His career is focused on Information Security, Innovation and Product Strategy, fields in which he has over 20 years of experience.
