Credential phishing emails are the clear favorite of threat actors, with a 478% spike last year, new research shows.

The sheer volume of phishing emails sent in 2022 spiked by a jaw-dropping 569% according to a just-released analysis.

After sifting through a global network of data from 35 million users, using artificial and machine learning analysis, Cofense researchers released their latest State of Email Security Report that details the astronomical rise of email phishing as a tactic among threat actors in 2022.

The email security report revealed five specific trends:

1.  The number of credential phishing emails sent spiked by 478%;
2.  Emotet and QakBot are the top malware families observed;
3.  For the eighth consecutive year, business email compromise (BEC) ranked as the top cybercrime;
4.  Web3 use jumped by 341%;
5.  And there was an 800% increase in the use of Telegram bots for exfiltration.

"The cybersecurity landscape is always evolving, so it is imperative to stay on top of the latest trends and tactics," Tonia Dudley, vice president and CISO at Cofense said about the email security report. "The increase in nation-state attacks and major incidents overall continues to apply pressure to drive visibility of an organization's security program by boards, corporate executives, and cyber insurers.”

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Phishing Emails Up a Whopping 569% in 2022

Security analysts expect little improvement until at least the second half of the year.

Financial activity in the cybersecurity industry declined sharply in the first quarter of 2023 compared to the same period in 2022, and analysts tracking the sector expect little improvement until at least the second half of the year.

Even that expectation is tinged with some uncertainty over how the market will respond — in the short and long term — to Silicon Valley Bank's (SVB) stunning collapse in mid March and the resulting impact on venture capital funding in the sector.

And meanwhile, next quarter in fact might be the slowest for cybersecurity startup funding in years, at least one researcher predicts.

**Continued Financial Headwinds for Cyber**

"Conservatism and expectations for continued headwinds throughout 2023 were the recurring themes across the public cybersecurity company annual earnings calls held throughout the first quarter," says Eric McAlpine, founder and managing partner at Momentum Cyber. "\[Strategic decision makers\] are approaching the rest of the year with great caution and that has downstream impact for everyone else in the ecosystem."

The cautionary tone comes amid lingering fears of a broad economic recession, falling stock prices and huge layoffs at technology giants such as Amazon, Meta, Microsoft, and Tesla. Though analyst firms such as IDC expect cybersecurity spending to increase 12.1% in 2023 to $219 billion, there are some fears that inflation and rising technology costs could dent the gains organizations are hoping to get from the increased spending.

McAlpine says that through Feb. 28, Momentum Cyber has tracked 32 cybersecurity M&A deals totaling $2.6 billion in disclosed deal value and 102 financing deals totaling $2.5 billion in value. That is down sharply from the M&A deal volume of $13.8 billion across 79 deals that Momentum Cyber tracked in the year-ago quarter. In Q2 last year, that number surged to a record $89.8 billon before dipping sharply in the last half of the year.

"Both M&A and financing deal count and dollar value are down considerably from the same period in 2022 as we continue to deal with turbulent markets," he says.

Market research firm Omdia reported a similar slowdown in the first quarter of 2023 with analyst Ketaki Borade describing the volume of M&A transactions so far this year as just over half of last year's volume in the same period: 44 versus 97 in 2022.

Notable M&A examples in the first quarter of 2023 include Thoma Bravo’s $1.1 billion acquisition of Magnet Forensics, Francisco Partners' purchase of Sumo Logic for $1.7 billion, and SailPoint's acquisition of SecZetta for an undisclosed sum in January.

**Broad Investment Slowdown, Including in VC**

It was not just M&A activity that slowed in the first three months of 2023. Venture capital and other investment activity in cybersecurity companies declined as well says Richard Stiennon, chief research analyst at market research firm IT-Harvest.

Stiennon says IT-Harvest tracked a total of 41 investments totaling some $1.35 billion in cybersecurity companies through March: "That is at an annual rate of only $8 billion \[which is\] considerably down from 2022, which saw investments of $17 billion, and 2021, which set an all-time high of $24 billion." 

Of the 41 investments, there were seven rounds of $50 million or more which accounted for $893 million of the total $1.35 billion, Stiennon says. There have been no initial public offerings (IPOs) so far this year.

Despite the general slowdown in cybersecurity M&A and investment activity, the first three months of 2023 had its share of major transactions. Easily the standout among them was Israeli cloud security vendor Wiz' capital raise of $300 million in a Series D financing round in February that valued the company at an astounding $10 billion, Stiennon says. That made Wiz the highest valued private cybersecurity firm ever.

Stiennon points to a $205 million growth funding round that identity management vendor Saviynt secured from AB Private Credit Investors and $180 million in equity investments and strategic financing that MDR vendor Deepwatch raised in February, as two other major deals in 2023's first quarter. Yet another was a $500 million capital raise by Alphabet spinoff Sandbox AQ in February.

**Hot Sectors**

As has always been the case, some segments within the cybersecurity industry received more love from investors than other segments. Rik Turner, an analyst with Omdia, identified the segments that have received the largest amounts of funding so far in 2023 as network security, security management, and SecOps. These sectors have perennially been attractive to investors, he says. 

"Others such as cloud, application, and data security are now also mainstays within the overall totals," Turner says. "\[The trend\] speaks to the growing amount of cloudification of app infrastructures, which was already underway before the pandemic, but was undoubtedly turbocharged by it."

Several of the technologies that investors are betting on are also — unsurprisingly — the areas where enterprise organizations are spending most of their security dollars on as well. In a recent Dark Reading virtual event, Chenxi Wang, founder and general partner of Rain Capital, identified cloud security, network security, identity and access management, SecOps, and application security as some of the top spending priorities for organizations currently.

In comments to Dark Reading, Wang says based on her observation, overall deal volumes and the velocity of strategic deals decreased in the first three months of 2023. "We observed the same thing on the venture side. Less companies are getting funded compared to last year."

**A Cautious Cyber-Investment Outlook for the Rest of 2023**

Wang and other industry analysts have a somewhat cautious outlook on M&A and investment activity in the cybersecurity sector for the rest of the year. 

One major issue is how SVB's demise will playout over the rest of the year. Wang believes — like many others — that the SVB collapse will make it harder for startups and early-stage companies — especially those with a high-risk appetite — to get funding. 

"In the long run, it means less companies will cross the chasm to scale up and become a sustainable business," she says.

McAlpine is less concerned about the short-term implications of SVB's implosion. The immediate slowdown in financial activity that the bank's collapse triggered has already begun reversing itself. But the longer-term impact may not be evident for years. 

"Going forward, we're advising companies to avoid putting all their eggs in one basket," he says. "Working with multiple banks, for example, \[such as\] one global bank and one regional bank, can help to avoid business interruptions during this period of volatility in the banking system."

He expects that things will start to loosen up sooner rather than later. Financing and M&A activity can't remain in a state of limbo forever, he says. Many companies will still need capital to reach the next stage of their business, even if they're able to adjust and extend their runway near term. "We also expect to see more companies take a parallel approach where they pursue financing and M&A at the same time," he says. "This gives them optionality if one or the other doesn't materialize at a valuation that's acceptable to founders and investors."

Steinnon, who expected a lot of funding that didn't happen last year to be pushed into 2023, says he is underwhelmed by what he has seen so far this year. But he predicts investment and M&A activity will begin ticking upward starting in the third quarter and will at least match 2020's total of $10 billion. 

He predicts that the second quarter of 2023 will be the slowest investment quarter in years in the cybersecurity industry. 

"Fallout from SVB's failure is going to have a negative impact on all funding, including in cybersecurity," he says. "I fully expect private equity to take advantage of decreased valuations \[and\] to snap up deals from the public and private sectors."

Cybersecurity Investment Outlook Remains Grim as Funding Activity Sharply Declines

With an infrastructure for observability, security teams can make better decisions about access and identity-based threats.

When it comes to security, you can't protect what you can't see. That's why organizations that can visualize and understand their data are in a much better position to thwart cyberattacks and breaches. Observability is the best way for businesses to change how they detect and remediate cyberattacks — so much so that the observability market is expected to reach $2 billion by 2026.

While observability isn't a mainline discussion in the identity security space, it's an essential piece of the puzzle, shining a light on the attack surface that allows teams to identify and prevent breaches. By layering observability with identity management, security teams have access to more data on identity-based threats, and fewer silos to break down as they race to identify and prevent attacks.

**Observability's Role in the Threat Landscape**

Observability enables organizations to fully see, understand, and manage their systems. For example, data observability gives business leaders a clear picture of the data they have, where it's stored, and who has access. It lets teams know if their systems, servers, and applications are functioning properly and can identify downtime or vulnerabilities. A recent report found that the most sophisticated observability practitioners cut downtime costs by 90%, to $2.5 million versus $23.8 million, for observability beginners.

This is especially true when it comes to managing the identity attack surface. The sprawl of applications and systems employees are connected to is increasing exponentially, and security teams need specific information in order to determine which kinds of access are legitimate and which are risky. By getting full visibility into these systems, teams can track metrics about access over time and set clearer policies.

**Establishing a Baseline of Normal**

Observability not only helps to establish a baseline of "normal behavior," but helps identity and access management (IAM) systems use data to make valuable decisions that protect business operations and directly contribute to positive business outcomes. This strategy, known as behavior-driven governance, takes granular data about how people actually use their identities and access privileges, rather than what a business assumes they're doing.

Three types of data matter the most in setting a baseline:

*   **Metrics:** Quantifying performance, including key performance indicators (KPIs) such as response time, error rates, alerts, etc.
*   **Traces:** Allowing IT teams to locate the source of an alert (i.e., which part of a login process is vulnerable to bugs)
*   **Logs:** Answering the who, what, where, when, and how of access activities with contextual event information

For example, a security team using observability could monitor certain metrics, such as when employees sign in and sign out of a system, their location and their keystrokes, then look at the data over a 60- or 90-day period to form a baseline for "normal" utilization. If a log shows that an employee has access to 15 applications and only uses five on a regular basis, the team can revoke access to the unused apps to minimize risk.

If the company only has US employees and North American suppliers, and there's a login attempt from Singapore, it's easier to log that as a red flag and investigate. Better observability into data and the patterns associated with it can help businesses detect potential breaches quickly and efficiently.

To get the most out of observability, these three types of data should be used together to gain an overall understanding of the identities a business manages.

**Third-Party Observability**

Data observability should be built into systems; often it is, but its context changes as customers request different capabilities. For example, if customers want authentication-as-a-service, and choose to plug in an authentication module and let a third party handle that, they surrender their observability to the third party to some degree. These customers won't have access to performance metrics around the app's authentication modules, and they might not know what baseline behavior actually looks like unless they ask that third party for granular details.

Regardless of how much a security team builds versus buys its identity security infrastructure, it must make sure observability is built in from the start. Take Netflix as an example: At the beginning of the year, the company embarked on a plan to crack down on password sharing to stop users from accessing the app from devices not associated with their home network. While the company quickly walked back that plan amid user backlash, the original idea provides an interesting case study for how to use observability for identity security. To set identity management policy that is accurate, Netflix would have needed to be able to process, visualize, and get full observability into user data — everything from where users log in most to what time of day they're most likely to watch.

So, what can we take away from this example? How can businesses set up a data-first observability framework to use this data and set accurate policies? I'd suggest that all enterprises need to follow these best practices when it comes to setting up a data-first observability approach to security:

*   Key observability metrics based on organizational business priorities
*   Executive buy in to, and organization-wide education on, a culture of observability, data access, and governance
*   A pipeline to centralize and standardize data sources (like metrics, logs, and traces) that can be used to identify baseline and "abnormal" behavior
*   Analytics tools and automated processes (like RPA software bots) that can sort through the noise of alerts

Businesses already have much of the data they need on identity management. By implementing an infrastructure for observability, security teams can break through the noise and make better decisions about access and identity-based threats.

Using Observability to Power a Smarter Cybersecurity Strategy

Google TAG researchers reveal two campaigns against iOS, Android, and Chrome users that demonstrate how the commercial surveillance market is thriving despite government-imposed limits.

Researchers from Google's Threat Analysis Group (TAG) have discovered two separate, highly-targeted campaigns that use various, unpatched zero-day exploits against users of both iPhone and Android smartphones to deploy spyware.

The discoveries — revealed in a blog post on March 29 — are the result of active tracking that Google TAG does of commercial spyware vendors, with more than 30 of them currently on the radar screen, the researchers said. These vendors sell exploits or surveillance capabilities to state-sponsored threat actors, thus "enabling the proliferation of dangerous hacking tools, arming governments that would not be able to develop these capabilities in-house," the researchers wrote. These are often used to target dissidents, journalists, human rights workers, and opposition-party politicians in potentially life-threatening ways, they noted.

The use of surveillance technologies is currently legal under most national or international laws, and governments have abused these laws and technologies to target individuals that don't align with their agendas. However, since this abuse came under international scrutiny due to the revelation of governments abusing NSO Group's Pegasus mobile spyware to target iPhone users, regulators and vendors alike have been cracking down on the production of and use of commercial spyware.

In fact, on March 28, the Biden administration issued an executive order that falls short of an outright ban on spyware, but restricts the use of commercial surveillance tools by the federal government.

Google's findings this week show that those efforts have done little to thwart the commercial-spyware scene, and "underscore the extent to which commercial surveillance vendors have proliferated capabilities historically only used by governments with the technical expertise to develop and operationalize exploits," TAG researchers wrote in the post.

Specifically, the researchers discovered what they characterize as two "distinct, limited, and highly targeted" campaigns aimed at users of Android, iOS, and Chrome on mobile devices. Both use zero-day exploits and n-day exploits. Regarding the latter, the campaigns take particular advantage of the period of time between when vendors release fixes for vulnerabilities and when the hardware manufacturers actually update end-user devices with those patches, creating exploits for unpatched platforms, the researchers said.

This demonstrates that those creating the exploits are keeping a close eye on vulnerabilities that they can exploit for nefarious purposes and are likely colluding to maximize the potential for using them to compromise targeted devices, according to TAG. The campaigns also suggest that surveillance software vendors share exploits and techniques to enable the proliferation of dangerous hacking tools, the researchers wrote in the post.

**The iOS/Android Spyware Campaign**

The first campaign that researchers outlined was discovered in November and exploits two vulnerabilities in iOS and three in Android, including at least one zero-day flaw each.

Researchers found initial access attempts that affect both Android and iOS devices that were delivered via bit.ly links sent over SMS to users located in Italy, Malaysia, and Kazakhstan, they said. The links redirected visitors to pages hosting exploits for either Android or iOS, then redirected them to legitimate websites — "such as a page to track shipments for Italian-based shipment and logistics company BRT, or a popular Malaysian news website," researchers wrote in the post.

The iOS exploit chain targeted versions prior to 15.1 and included an exploit for a WebKit remote code execution (RCE) flaw, tracked as CVE-2022-42856, but a zero-day at the time of the exploit. It involves a type confusion issue within the JIT compiler, the exploit used a PAC bypass technique fixed in March 2022 by Apple. The attack also exploited a sandbox escape and privilege escalation bug in AGXAccelerator, tracked as CVE-2021-30900, which was fixed by Apple in iOS 15.1.

The final payload of the iOS campaign was a simple stager that pings back the GPS location of the device and also allows the attacker to install an .IPA file (iOS application archive) onto the affected handset, researchers said. This file can be used to steal information.

The Android exploit chain in the campaign targeted users on devices that use an ARM GPU running Chrome versions prior to 106, the researchers said. There were three vulnerabilities exploited: CVE-2022-3723, a type confusion vulnerability in Chrome that was fixed in last October in version 107.0.5304.87, CVE-2022-4135, a Chrome GPU sandbox bypass only affecting Android that was a zero-day when exploited and fixed in November, and CVE-2022-38181, a privilege escalation bug fixed by ARM last August.

The significance of attacking ARM and CVE-2022-38181 in particular is that when the fix for this flaw was initially released, several vendors — including Pixel, Samsung, Xiaomi, and Oppo — did not incorporate the patch, giving attackers several months to freely exploit the bug, researchers said.

**Samsung Browser Cyber-Espionage Campaign**

Google TAG researchers discovered the second campaign, which includes a complete exploit chain using both zero-days and n-days to target the latest version of Samsung Internet Browser, in December. The browser runs on Chromium 102 and has not been updated to include recent mitigations, which would have required attackers to do additional work to carry out the exploit, the researchers said.

Attackers delivered the exploits in one-time links sent via SMS to devices located in the United Arab Emirates (UAE), the researchers said. The link directed users to a landing page identical to one present in the Heliconia framework developed by commercial spyware vendor Variston, they added.

The payload of the exploit in this case was a C++-based, "fully-featured Android spyware suite" that included libraries for decrypting and capturing data from various chat and browser applications, the researchers wrote. They suspect that the actor involved may be a customer, partner, or otherwise close affiliate of Variston.

Flaws exploited in the chain were CVE-2022-4262, a type confusion vulnerability in Chrome that was a zero-day at time of exploitation, CVE-2022-3038, a sandbox escape in Chrome fixed in version 105 in June 2022, CVE-2022-22706, a vulnerability in Mali GPU Kernel Driver fixed by ARM in January 2022, and CVE-2023-0266, a race condition vulnerability in the Linux kernel sound subsystem providing kernel read and write access that was a zero-day at the time of exploitation.

"The exploit chain also took advantage of multiple kernel information leak zero-days when exploiting CVE-2022-22706 and CVE-2023-0266" that Google reported to ARM and Samsung, the researchers wrote.

**Limiting Spyware & Protecting Mobile Users**

TAG researchers provided a list of indicators of compromise (IoC) to help device users know if they're being targeted by the campaigns. They also stressed how important it is for vendors as well as users to update their mobile devices with the latest patches as quickly as possible after vulnerabilities and/or exploits for them are discovered.

"A big takeaway here would be to use fully updated software on fully updated devices," Google TAG researchers say in response to questions posed by Dark Reading. "In this case, none of the exploit chains described would have worked."

Google: Commercial Spyware Used by Governments Laden With Zero-Day Exploits

For the foreseeable future, with the spigots closing shut, CISOs will need to find ways to do more with less.

It's always easier to upgrade an organization's defenses when times are flush and money's no object. But try getting your CFO to fund a new cybersecurity project when the boom goes bust.

Good luck with that.

In the immediate past, the security function received ample investment to add staff and equip teams with the latest and greatest security tools. But when uncertainty clouds the economic climate, companies rein in overall spending, reduce head count, and back away from investment projects not deemed essential. This is also when CISOs get put to the test. 

The security leaders of the organization don't have the luxury of sitting on their hands until the business cycle picks up again. Threat actors operate during good times and bad, and trust me, they will find –— and exploit — vulnerabilities that emerge from neglected defenses.

But for the foreseeable future, with the spigots closing shut, CISOs will need to find ways to do more with less.

**Dealing With a New Reality **

That sounds painful, but CISOs can handle the drill. Speaking as a former CSO, we're always under pressure to achieve more, especially when the cost of all that security overhead comes under scrutiny.  

CISOs now find themselves operating in a new environment. In short, the new reality imposes a new discipline.

For starters, security departments need to learn to be leaner than in previous years as the C-suite directs them to squeeze more out of their current technology deployments. The new marching orders will challenge their skills as business managers, forcing them to step beyond their comfort zone as technologists, perhaps for the first time. 

In practice, that may require them to reduce head counts while reviewing their security ecosystems to eliminate overlaps while amplifying supporting controls. They'll also need to demonstrate that the tools they're using are working as expected and that they're optimized by deploying the latest available intelligence.  

Some CISOs might want to push back. But savvy CISOs will recognize they need to demonstrate that they can run a smart operation, just as smartly as the rest of the other departments in the business.

If you want your organization's security to be fit, then accept the oversight and invite the new rigor coming from your board. Do the necessary advance work and be prepared to defend your asset deployment. That is just sound business practice. 

If you can explain how you're spending the company's dollars to secure the business and demonstrate that you're running an efficient operation, it pays off later on. When new threats do materialize and you make a case for a bigger budget, you'll be presenting to a more supportive and appreciative board.

When I was running cybersecurity at BT, I examined how we were set up and discovered that we had far more managers than doers. In other words, we were top-heavy with more tiers of management than was needed. So I restructured our operations to flatten the org chart, giving the employees more responsibilities and accountabilities across a broader base.

At first blush, that sounds as if I squeezed people harder than ever. But it was just the opposite. We were giving them broader, more enriched roles because the people that work in security have a real passion for what they do. All they ask is to be given the environment, the tools, and the data to do a great job. So my role was to promote that rationalization and make sure we were properly aligned to have the best-possible impact defending against attackers. And after expanding the responsibilities of the people in my security teams, guess what? They loved it.

**Winding Up Stronger Long Term**

Everyone has an innate immunity to change, but this is a moment where CISOs must step up to meet the challenge. With knowledge comes power: Not only will they learn a lot about the true capabilities of their own security organizations, but they'll also wind up more able to define future security strategy. 

Gaining a clear idea about your attack surface is a fundamental prerequisite if you hope to marshal your resources against the types of attacks heading your way. Do you have the right overlapping controls? Have you got controls that have been around for a long time? If so, are they still delivering value or have they become expensive albatrosses? If so, get rid of them and lighten up the operational costs on your teams, so you can double down on the things that matter. 

Next, consider what intelligence you have, and what you wish you had access to. If you're a CISO of a major financial institution, for example, might it be beneficial to know what threat intelligence other CISOs from competitor organizations are gathering? It might be counterintuitive to share information with rivals, but it's time to reframe our thinking around what's truly proprietary and what information we could all benefit from. Sharing threat intelligence through communities like Information Sharing and Analysis Centers (ISACs), Information Sharing and Analysis Organizations (ISAOs), and others is an effective way to bolster your defenses without having to start from scratch.

Elsewhere, have you made sure that your offboarding processes are working properly and limiting data access? Over the years, some employees may have aggregated access privileges that no longer make sense given their current jobs. That's a recipe for major trouble if they get compromised. 

Do all this so if (and when) you're ordered to make cuts, you can talk from a position of knowledge, and also ensure you're getting the most out of your existing investments. Remember, security doesn't live in products; it lives in intelligence and your ability to access and put that intelligence to work. Having done the requisite analysis, you'll be talking in business terms back to your board. That's a language they will understand and it will set you up to be stronger in the long term.

The CISO Mantra: Get Ready to Do More With Less

With the rise in cloud-based security concerns and other issues, organizations must improve data literacy across the enterprise.

**Question: How does data literacy enhance data security in the enterprise, and why is it important to enterprise security?**

**Sam Rehman, SVP and CISO, and Taryn Hess, Ph.D., Principal, Business Consulting, EPAM Systems:** The shift to cloud computing is perhaps the most significant tech trend of recent years, with the public cloud computing market expected to be worth more than $800 billion by 2025. From decreasing IT costs to increasing opportunities for innovation, the cloud holds many benefits for companies across every industry. However, many employees are unprepared to securely set up cloud applications or unaware of how poor configuration could affect data security. One of the main reasons why organizations struggle to secure their cloud environments is a companywide lack of data literacy.

In today's marketplace, a data-literate workforce — one that uses data as a company asset in decision-making, evaluates and questions data, knows how to find data, and confidently interacts with data to derive insights and tell a story about it — is critical to business success. In a 2022 survey by the Data Literacy Project, only 11% of respondents were fully confident in their data literacy skills. It is of the utmost importance that businesses engage in efforts to enhance data literacy, which will improve data security.

**Data Handling and Classification**

Fundamentally, data leaks are a result of insufficient data literacy. These incidents stem from someone not fully understanding the value of a particular data set and mishandling it by either sharing it with people who shouldn't have access or leaving it unprotected and exposed to hackers.

The consequences of not understanding and mishandling data can be costly, causing damage to brand reputation, and, should proprietary information be stolen, a company could lose market share to a competitor. Moreover, if an employee's potentially identifiable information (PII), such as their health records or religion, is leaked in a data breach, that person could be in danger.

From a data literacy perspective, everyone within a company should consider themselves a data security ambassador. Indeed, a sufficient understanding of the data an employee uses regularly will empower them to secure it properly. Of course, there are layers to data literacy within a business, as some roles require greater literacy than others — i.e., data scientists and architects compared with legal or HR personnel.

One of the main ways people can increase their data literacy is by learning data labels. In particular, people must be aware of a data set's classification and have adequate knowledge to handle that information accordingly.

Today, commercial businesses leverage data classifications similar to those the government uses, including public, internal, confidential, and restricted levels. Public data is nonsensitive information available to anyone via the company website. Internal data, such as the employee handbook, is reserved for those within the organization. Confidential data, like pricing or marketing materials, must remain limited to select teams. And restricted data, such as trade secrets or PII, is highly sensitive and could be disastrous should it be disclosed.

**Data Maturity Assessment and Culture Transformation**

Improving data literacy is a multifaceted process. To establish a baseline, brands can conduct a data maturity assessment or map data security competencies (knowledge, skills, and abilities) across every role in a company. Organizations can determine their data maturity by checking what isn't working, be it a lack of communication or misunderstanding from not speaking the same language, such as the same term meaning different things for different departments.

From there, businesses can build growth plans and create opportunities for everyone in the organization to upskill on data security based on their roles. Likewise, a data maturity assessment will reveal whether an organization needs to look outside of itself for talent.

Though the previous methods are critical to improving data literacy, almost 92% of executives rate culture as the greatest barrier, making it the top priority in this area. Shifting a culture to one that embraces data literacy can be tricky; however, by involving the right leaders and stakeholders, companies can ensure alignment across the enterprise.

Once leadership has bought in, organizations can engage everyone with data security through various means, including newsletters, project meetings, town halls, online learning, workshops, etc. Likewise, it's critical to drive awareness of potential threats, like phishing attacks, data loss, or cloud misconfiguration.

**Data Literary Undergirds All Security Efforts**

Although various strategies, such as deploying policy and encryption to protect cloud environments, are necessary to minimize the impacts of data breaches, companywide data literacy undergirds the effectiveness of such methods and must remain a priority. Indeed, data handling and proper attention to the different classifications will empower people to use data safely, driving innovation and business success.

How Does Data Literacy Enhance Data Security?

Microsoft's new AI assistant tool helps cybersecurity teams investigate security incidents and hunt for threats.

Microsoft has been leaning into its $10 billion investment in OpenAI by introducing AI assistants – all called Copilot – across its product portfolio. The latest one is Microsoft Security Copilot, to help security teams investigate and respond to security incidents.

Defenders are having a hard time dealing with a very dynamic security environment, and Microsoft Security Copilot is intended to make defenders’ lives better by using artificial intelligence to help them catch incidents that they may otherwise miss, improve the quality of threat detection, and speed up response, says Chang Kawaguchi, vice president and AI Security Architect at Microsoft. Security Copilot uses both OpenAI’s GPT-4 generative AI model and Microsoft’s proprietary security-based model to identify breaches, connect threat signals, and analyze data.

Security Copilot is intended to make “defenders’ lives better, make them more efficient, and make them more effective by bringing AI to this problem,” Kawaguchi says.

Security Copilot will ingest and make sense of huge amounts of security data – including the 65 trillion security signals Microsoft pulls every day and all the data being collected by the Microsoft products the organization is using, such as Microsoft Sentinel, Defender, Entra, Priva, Purview, and Intune. Analysts can summarize incidents, analyze vulnerabilities, and look up data on common vulnerabilities and exposures.

Analysts and incident response teams will be able to type what they are trying to understand into a text prompt – “/ask about” – and Security Copilot will return responses based on what it knows of the organization’s data. This way, security teams will be able to see connections between various parts of a security incident, such as a suspicious email, a malicious software file, or the different parts of the system that had been compromised, says Kawaguchi. The queries could be general, such as an explanation of a vulnerability, or specific to the organization’s environment, such as looking in the logs for signs that a particular Exchange flaw had been exploited. And because Security Copilot uses GPT-4, it can respond to natural language questions.

The analyst can see summaries of what happened and then follow prompts from Security Copilot to drill down deeper in the investigation. All these steps can be saved in a “pinboard,” which can be shared with other members of the security team as well as stakeholders and senior executives. All the tasks that have been completed are saved and readily accessible. There is also an automatically generated summary which will update as new tasks are completed.

“This is what makes this experience more of a notebook than a chat bot experience,” says Kawaguchi, noting that the tool can also create PowerPoint presentations based on the investigation that the security team can use to share the details of the incident afterward.

Security Copilot is not designed to replace human analysts, but to provide them with the information they need to move quickly and at scale during the course of an investigation, Kawaguchi says. Threat hunters can also use the tool to determine whether an organization is susceptible to known vulnerabilities and exploits by examining each asset in the environment, according to the company.

Forrester Senior Analyst Allie Mellen said in an email that Security Copilot was the first time a product focused on using AI to improve investigation and response. Previously AI tended to focus more on detection, Mellen said.

In a demo, Kawaguchi showed how Security Copilot can look at a cyberattack and figure out how the malware got into the network and infected the victim’s machine. Security Copilot can perform log analysis, display alert summaries, and generate graphs and other visualizations to show the sequence of events in the incident. The tool can also suggest steps for remediation and guidance.

If the information provided looks incorrect, or “off target,” there is a way to provide feedback immediately so that the model can learn. Security Copilot will continually improve as it learns from the company’s own data, as well as Microsoft’s extensive security research and visibility over the global threat landscape. However, the organization’s data will never be used to train the main Security Copilot algorithm, Kawaguchi says.

Microsoft has been flexing its AI-clout in recent weeks, going beyond Copilot in GitHub, which helps developers write code. A few weeks ago, the company announced Microsoft 365 Copilot, which allows users to use Copilot to do things like put together a PowerPoint presentation and write up articles in Word. Copilot in Dynamics 365 helps sales and customer success representatives engage with customers and prospects by sending natural-sounding messages, rather than relying on premade boilerplate messages.

Security Copilot is currently in private preview; Kawaguchi declined to specify a date for when it will be generally available, noting that it all depended on how organizations wind up using the tool. There are also long-term plans for extending Security Copilot to ingest information from other security vendors’ products.

“Security Copilot is poised to become the connective tissue for all Microsoft security products and, importantly, will integrate with third-party products as well,” Forrester’s Mellen said.

“We think that AI has the opportunity to change the game for almost all things that security folks do. We're starting with the investigation flow because this is the one where we think there's a massive amount of opportunity for efficiency and effectiveness,” Kawaguichi says.

Microsoft Security Copilot Uses GPT-4 to Beef Up Security Incident Response

A novel cyber threat against macOS users is being sold for $100 a pop on the Dark Web, and activity is ramping up.

An information-stealing malware that targets Apple's macOS operating system is making the cyberrounds, siphoning off documents, iCloud keychain data-like passwords, browser cookies, and more from unwitting Apple users.

Appropriately dubbed "MacStealer," it's going for just $100 per build on the cyber underground, so it's no surprise that "more MacStealer samples have been spreading recently," according to a recent Uptycs analysis on the threat.

The malware affects the Catalina version of macOS and subsequent versions that use Intel M1 and M2 CPUs. It also uses the encrypted Telegram messaging platform for command-and-control (C2), the researchers found.

To propagate, operators are looking for low-hanging fruit, hoping to harvest victims by luring them to download .DMG files, which are containers for macOS apps. Fake apps in app stores, piracy websites, or email attachments could all be potential conduits for infection.

"The bad actor uses a .DMG file to spread the malware. After a user executes the file, it opens a fake password prompt," Uptycs researchers explained in the post. "Once the user enters their login credentials, the stealer … \[compresses\] the data and sends it to C2 via a POST request using a Python User-Agent request. It deletes the data and ZIP file from the victim's system during a subsequent mop-up operation."

This is just the latest malware to target Macs in recent months. In February, pirated versions of Apple's Final Cut Pro video-editing software were found delivering a version of the XMRig cryptocurrency mining tool. And last year, a previously-unknown, macOS spyware called "CloudMensis" surfaced in a highly targeted campaign, exfiltrating documents, keystrokes, screen captures, and more from Apple machines.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

MacStealer Malware Plucks Bushels of Data From Apple Users

The NullMixer loader has compromised thousands of endpoints in the US, France, and Italy, stealing data and selling it to Dark Web data dealers, all without setting off alarm bells.

A new version of the NullMixer dropper includes polymorphic loaders from malware-as-a-service (MaaS) and pay-per-install (PPI) providers on Dark Web markets, and it's being used to target organizations in North America, as well as Italy and France.

The malware, a known threat, typically installs a suite of downloaders, banking Trojans, stealers, and spyware on victims' systems, all in one go. The new additions, however, make the threat even more dangerous, according to a detailed NullMixer analysis this week from Security Affairs, because the threat can adapt to whatever the specific environment is that it infects.

The analysis also explains how threat actors have been using search engine optimization (SEO) poisoning and malicious video tutorials to con IT staff into installing the new malware. In just one month, the newly enhanced NullMixer malware has established initial access into more than 8,000 endpoints, stealing data to sell it to brokers in underground markets.

Most victims are running Windows 10 Professional and Enterprise operating systems, the NullMixer report said, adding that the malware also seems to have successfully infected Windows Embedded IoT environments.

"The NullMixer package is including new polymorphic loaders by third parties MaaS and PPI service providers in the underground markets, and also pieces of controversial, potentially North-Korean linked PseudoManuscript code," the researchers explained about the latest NullMixer malware strain. "Our insights into a recent NullMixer malware operation revealed Italy and France are the favorite European countries from the opportunistic attackers' perspective."

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

NullMixer Polymorphic Malware Variant Infects 8K Targets in Just a Month

A lack of website protections, Sender Policy Framework (SPF) records, and DNSSEC configurations leave companies open to phishing and data exfiltration attacks.

The risk score for the average company worsened in the past year as companies fail to adapt to data exfiltration techniques and adequately protect Web applications.

Companies' effective data-exfiltration risk increased to 44 out of 100 (with 100 indicating having the riskiest posture) in 2022, from an average score of 30 in the previous year, indicating that the overall risk of data being compromised has increased. That's according to rankings by Cymulate, which crunched the data on 1 million pen tests, including 1.7 million hours of offensive cybersecurity testing within its production environments.

In its "2022 State of Cybersecurity Effectiveness" report, published on March 28, the firm noted that there are various persistent problems leading to increased risk. For one, while many companies are improving their adoption and the strictness of network and group policies, attackers are adapting to sidestep such protections, the report stated. 

And the basics continue to lag: The company found that four of the top-10 CVEs identified in customer environments were more than two years old. These include the high-severity WinVerifyTrust signature validation vulnerability (CVE-2013-2900), which can allow malicious executables to pass security checks, and a memory corruption vulnerability in Microsoft Office (CVE-2018-0798).

    

How Cymulate scores risk. Source: Cymulate

There is good news, however. Data from the security assessments indicates that companies have all improved risk scores for malware detection across major platforms, and many attacks are blocked by Web gateways. 

Overall, businesses need to treat cybersecurity like any other business process, with regular checks on controls, says Mike DeNapoli, director of technical messaging for Cymulate.

"Cybersecurity needs to become a process treated like any other business process, with checks and balances and regular review," he says. "The CFO would never permit the books to remain closed except for once per year, but the systems that house all that money as data routinely only get checked out during an annual pen-test, which has to change."

All of this comes against the backdrop that companies are increasingly focused on securing their entire attack surface, improving resiliency to cyberattacks, and preventing disruption of information systems. As a result, cybersecurity services and products that reduce complexity have become more popular while large technology firms have thrown their hat into the ring, such as Microsoft's launch of Defender External Attack Surface Management in August and IBM's purchase of ASM startup Randori in June. Time will tell if these trends will move the needle on risk.

    

While the exposure risk due to WAFs has dropped, data-exfiltration risk has increased. Source: Cymulate

Meanwhile, Cymulate's analysis of a year of offensive cybersecurity testing also found that cloud and email continue to provide rich sandboxes for hackers.

**Attacks Increasingly Coming From Popular Clouds**

Attackers have shifted some aspects of their attacks away from using popular file sharing services, such as Dropbox and Box to evade email attachment filters and other security technologies, to using more generic cloud infrastructure, such as Amazon and Azure. Businesses have a harder time blocking data from large, trusted service providers, which serve as the backbone for many large cloud services and websites, DeNapoli says.

"These metrics are applied to hundreds of attempts to remove data that should be considered 'controlled' from the organization," he says. "This increase means that organizations have less control over preventing business confidential, personally identifiable, and other controlled data from being removed from the organization in unauthorized ways."

The top most successful tactics used by simulated attackers in the Cymulate research included attacking users through their browsers in a drive-by compromise scenario, archiving and exfiltrating data, and transferring that data to a cloud account, such as AWS or Azure.

**"Email Defenses Are a Team Sport"**

Nearly half of the top 10 exposures uncovered by Cymulate's pen testing involved a lack of security for basic IT infrastructure. The simulations discovered that common issues included not recognizing phishing domains, a failure to configure DNSSEC, and a lack of two technologies — Domain-based Message Authentication, Reporting, and Conformance (DMARC) and Sender Policy Framework (SPF) — that can help stop email-based attacks.

Overall, companies have been slow to deploy critical email security and integrity technologies, such as DMARC, SPF, and a third technology, Domain Keys Identified Mail (DKIM) — together which can help prevent phishing success and brand fraud. While companies which implement DMARC, DKIM, and SPF records can better protect against email-based attacks, the technology standards are only truly effective if both sides of an exchange are using them, DeNapoli says.

"We need to begin to recognize that email defenses are a team sport and implement our part of the processes so others can be safer," he notes. "The benefit is that as more and more organizations implement these processes, our organization also becomes safer."

The report also showed that different industries have different strengths and weaknesses. The education and hospitality sectors, for example, had the highest risk of data exfiltration, while protections against the most immediate threats were lowest in the technology sector. Both technology and government organizations had worse-than-average Web application firewall protection.

Source

DARKReading