Manufacturing industry most often hit by ransomware

The manufacturing industry is a popular target for cybercriminals. Parties in the sector are the most frequent targets of cybercrime of all sectors. These include various forms of cybercrime.

This is according to the IBM X-Force Threat Intelligence index survey, based on data from 2021. The manufacturing industry is a favourite target of cybercriminals. Of all the attacks that IBM X-Force prevented, a whopping 23% targeted manufacturing companies. This shows a shift; last year, financial organisations, on the contrary, were in first position.

According to IBM, the rise is partly due to the growing embrace of the SCADA MODBUS communication protocol and Internet of Things (IoT) devices. For instance, cybercriminals appear to be much more likely to actively search for vulnerable SCADA MODBUS and IoT devices connected to the internet. The number of searches on these would be as much as 22 times higher than in the previous edition of the report.

IBM research based on data from 2021 suggests that 27% of attacks on companies in the manufacturing industry were aimed at extortion. Ransomware is a well-known example of this, but other forms of cybercrime can also be introduced for this purpose. Consider the aforementioned DDoS attacks.

It is also striking that European companies are a popular target for cybercriminals. For example, 44% of the attacks investigated in IBM's survey were found to be aimed at European targets.

"If attackers see a weakness, they exploit it," IBM reports in the report. This is also the case with the manufacturing industry, the US company argues. It refers to the low tolerance for downtime in the manufacturing industry, in which 24/7 processes are central. Cybercriminals capitalise on this by disrupting these continuous operations, which can result in substantial financial losses.

Attackers do this in various ways. Consider CEO fraud, a form of cybercrime in which attackers pose as a high-ranking manager of the company. From this position, they approach an employee, for example from the finance department. The so-called manager claims, for example, to have closed a big deal, but needs a large amount of money at short notice to do so. The employee is asked to make this amount available. Because an employee appears to be approached by a top manager of his or her company, the chances of success are relatively high.

However, also consider Distributed Denial of Service (DDoS). In this form of cybercrime, attackers flood a company's server with rogue requests. The server becomes overloaded and can no longer process legitimate requests from users. As a result, the server and the application and/or website running on it are inaccessible. For example, a website, web shop or business application can be taken down.

A third example is ransomware. This is a form of malware that attackers use to encrypt systems and data, taking them hostage. In many cases, attackers then demand a ransom from the victim in exchange for the decryption key. The advice is generally never to pay. For instance, there is no guarantee that the attackers will actually hand over the decryption key after payment. Also, paying a ransom can encourage cybercriminals to carry out more ransomware attacks. Increasingly, attackers are also leaking victims' data, with the aim of increasing the pressure further.

For the second year in a row, phishing is a major method for cybercriminals to gain access to targets. This is a form of cybercrime where attackers try to convince victims to hand over data. Think of login details. For this, they pretend to be a helpdesk or colleague, for example. Phishing played a role in 41% of all security incidents investigated.

More than half of the cases involved spear phishing. This is a form of phishing in which attackers tailor their phishing attempt to their target. In this way, they link to a victim's interests or field of expertise, for example. Because the phishing attempt fits the target well, the attack is more likely to be successful.

Besides phishing, applications accessed via the internet are also regularly targeted. 26% of attacks targeted such applications. in 16% of cases, attackers used valid accounts. These include, for example, accounts from which attackers have captured login credentials.

Several cybercrime groups are active, with IBM Security citing REvil as an example. This attack group is now reportedly inactive following an action by Russian intelligence in January 2022. IBM Security holds the group responsible for 40% of all ransomware attacks carried out in 2021.

Group was estimated to have been carrying out ransomware attacks for about three years. With that, the group has been active for a remarkably long time. According to IBM Security, the average ransomware group disappears about 17 months after its creation.

One effective measure IBM X-Force suggests is zero-trust. In practice, this means trusting nothing and controlling everything. The principle was developed by John Kindervag in 2010. Whereas companies used to label the internal network as secure, with zero-trust, a 'secure internal network' does not exist. In practice, this means that you continuously verify the identity of devices and users.

Network segmentation also plays an important role. In practice, this means dividing the network into small segments. Does an attacker penetrate a segment of your network? Then network segmentation ensures that an attacker cannot move freely across your network. This can help contain the damage.

In addition, IBM X-Force recommends creating an incident response plan. In such a plan, you lay down exactly how you will proceed in the event of a security incident. Who do you have to inform about it, for instance? How do you monitor business continuity? And what steps do you take to mitigate the attack as quickly as possible?

However, also consider security awareness training. With these, you raise employee awareness about security threats and cybercrime. Staff will learn how to recognise phishing attacks, among other things. However, also consider the impact of their own behaviour on the security of their organisation.

Further information on the survey is available here.

Author: Wouter Hoeffnagel
Photo: pixelcreatures via Pixabay