Attacks on equipment used in homes increased 210% in 2020, reaching almost 2.9 billion, for a total of 15.5% of all households, reveals research by cybersecurity company Trend Micro. The study points out that the vast majority of attacks (73%) on home networks were brute force, which is one in which an automated script tries to “guess” the login and password to gain control of a router or smart device. The target of hackers was to destabilize corporate systems and infect or compromise IoT (Internet of Things) devices through botnets.
Trend Micro says it detected 119,000 cyber threats per minute in 2020, as as home office work grew and the infrastructure used became more vulnerable and under pressure from new attacks.
The survey also reveals that email threats accounted for 91% of the 62.6 billion threats blocked by Trend Micro in 2020, showing that phishing attacks remain extremely popular. The company detected about 14 million unique phishing URLs that targeted distracted domestic workers.
“In 2020, companies faced an unprecedented amount of threats against their extended infrastructure, which includes workers’ home networks. Familiar tactics such as phishing, brute force and exploitation of vulnerabilities continue to be preferred by attackers, which should help in the development of defense tools, ”said Jon Clay, director of Global Threat Communications at Trend Micro.
Another piece of data from the study shows that ransomware families increased 34%, using “double extortion” attacks, those in which attackers steal data before encrypting it to force payment of the ransom, threatening to disclose the stolen information. This is a type of strategy that is becoming increasingly popular. Government, banks, the manufactured goods and healthcare sectors were the most targeted in 2020.
The number of vulnerabilities has also increased: 40% over the previous year. The Zero Day Initiative published 1,453 vulnerability alerts, of which almost 80% were classified as critical or highly serious. Many of the attacks targeted VPN flaws used by remote workers. CVE-2019-11510, a critical failure to disclose arbitrary files on the Pulse Connect Secure server, already has almost 800 thousand accesses, based on Trend Micro’s customer data.
Incorrect cloud configurations also had negative consequences in 2020. Trend Micro noted the exploitation of insecure APIs in several cryptocurrency mining attacks.
The only good news brought by the report is that there was a 17% drop in BEC (corporate email) attacks, although there is no indication of how many were successful.
Source: CisoAdvisor
