Threat chain targeting cloud services”

As the year 2022 draws to a close, Netscope, a secure access services company, has revealed its predictions on the top threats targeting cloud services, along with trends in threat actor behavior in 2023.

First, there is “ransomware as a service” where attackers focus on both encrypting and stealing sensitive data. On the other hand, we have extortion and material exploitation groups, such as the “Lapsos” and “Ransom House” groups.

It hacks companies with the sole purpose to get sensitive data without encrypting any file. We expect the year 2023 to be filled with attacks originating from “ransomware as a service” and extortion and physical exploitation groups, with the potential for “extortion as a service” attacks to escalate.

Software delivery security

In recent years, we have seen a significant increase in “software supply chain” attacks, due to the discovery of more vulnerabilities in application code, especially within open source software, and we expect these attacks to continue to grow in the next year and beyond. This calls attention to the need for organizations to improve their security measures and strategies to ensure the integrity of “software supply chains”.

“Industrial Metaverse”

These attitudes will start to change in 2023 from something esoteric to a broader recognition that key components like the digital store, supply chain automation and optimization via AI/ML models are real and relevant. The emergence of new cybersecurity challenges and a new attitude towards the industrial sector with the opportunity to carry out a profound technological transformation as an initiative to change the business.

Phishing

Phishing is a social engineering technique that needs to find a person and convince them that the attacker is legit and get them to give them their password or access to their personal accounts. MFA has long been touted as the “solution” to the phishing problem.

But what it actually does is force threat actors to change their behavior and tactics while carrying out this type of attack.

While there are alternative methods and tools that can bypass MFA, such as using reverse proxy phishing tools or even techniques to abuse workflows and secure direct access to cloud applications, we expect significant developments in phishing attacks that bypass the MFA.