Symantec is warning computer users to gear up for a busy year ahead with major service disruptions likely to increase in number and improve their ability to break through cyber defences.
Symantec technology strategist Mark Shaw said, in his cybersecurity predictions paper, incidents like the WannaCry attack, which affected more than 200,000 computers worldwide in May, were just the warm up to a new year of virulent malware and DDoS attacks.
Cybercriminals were poised to step up their attacks on the millions of devices now connected to the ''Internet of Things'' (IoT) both in their offices and homes.
Mr Shaw released a list of what to expect this year.
Blockchain would find uses outside of cryptocurrencies but cybercriminals would focus on coins and exchanges. Blockchain was finally finding application outside of cryptocurrencies, expanding its functions in inter-bank settlements with the help of IoT gaining traction.
However, those were still in their infancy stage and were not the focus for most cybercriminals.
Instead of attacking Blockchain technology itself, cybercriminals would focus on compromising coin-exchanges and users' coin-wallets since those were the easiest targets, and provided high returns. Victims would be tricked into installing coin miners on their computers and mobile devices, handing their CPUs and electricity to cybercriminals.
Supply chain attacks would become mainstream.
Supply chain attacks had been a mainstay of the classical espionage and signals-intelligence operators, compromising upstream contractors/systems/companies and suppliers. They were proven to have a high level of effectiveness, with nation-states using a mix of human intelligence to compromise the weakest link in the chain. The attacks were moving into the cybercriminal sphere, becoming mainstream. With publicly available information on suppliers, contractors, partnerships and key people, cybercriminals could find victims in the supply chain and attack the weakest link.
File-less and file-light malware would explode.
The past two years had seen consistent growth in the amount of file-less and file-light malware, with attackers capitalising on organisations lacking in preparation against such threats.
With fewer Indicators of Compromise (IoC), use of the victims' own tools, and complex disjointed behaviours, the threats had been harder to stop, track and defend against in many scenarios. Like the early days of ransomware, where early success by a few cybercriminals triggered a gold-rush like mentality, more cybercriminals were rushing to use these techniques.
Organisations will still struggle with Security-as-a-Service (SaaS) security.
Adoption of SaaS continued to grow at an exponential rate as organisations embarked on digital transformation projects to drive business agility. The rate of change and adoption presented many security challenges as access control, data control, user behaviour and data encryption varied significantly between SaaS apps.
Combined with new privacy and data protection laws adopted by regulators across the world, they would pose major implications in terms of penalties, and more importantly, damage to reputations.
Financial Trojans would still account for more losses than ransomware.
Financial Trojans were some of the first pieces of malware to be monetised by cybercriminals. From simple beginnings as credential-harvesting tools, they evolved to advanced attack frameworks targeting multiple banks, and banking systems that sent shadow transactions and hid their tracks. They had proven to be highly profitable for cybercriminals. Today, the move to mobile application-based banking had curtailed some of the effectiveness, and cybercriminals were moving attacks to those platforms.
Expensive home devices will be held to ransom.
Ransomware had become a major problem and was one of the scourges of the modern internet, allowing cybercriminals to reap huge profits by locking up users' files and systems. he specialists were considering expanding their attack reach by exploiting the massive increase in expensive connected home devices. Smart televisions, smart toys and other smart appliances could run into thousands of dollars and users were generally not aware of the threats to these devices, making them an attractive target.
