Quarter Four Cyber Security Insights 2022

This quarter, CERT NZ responded to 1,757 incident reports about individuals and businesses from all over New Zealand. This report shares information around these incidents as well as highlighting examples of work CERT NZ is doing to help. There are two parts to the report:

A Highlights Report focusing on selected cyber security incidents and issues.

A Data Landscape Report providing a standardised set of results and graphs for the quarter.

Highlights

The average number of incident reports per quarter is 2,124 and average direct financial loss is $4.6 million. These figures are based on the previous quarters.

$3.5 million in direct financial loss was reported in Q4. 26% of incidents reported financial loss

1,757 incidents were responded to by CERT NZ in Q4 2022, down 15% from Q3 2022

Ransomware reports increased 500% from Q3 2022.

10% increase in malware reports from Q3 2022

Number of incidents responded to

A total of 1,757 incidents were responded to in Q4 2022

Year	Quarter	Incidents
2022	4	1,757
2022	3	2,069
2022	2	2,001
2022	1	2,333
2021	4	3,977
2021	3	2,072
2021	2	1,351
2021	1	1,431

Breakdown by incident category

Phishing and credential harvesting remains the most reported incident category

Incident category	Incident count	Percent change from previous quarter
Phishing and credential harvesting	905	-2%
Scams and fraud	510	-27%
Unauthorised access	178	-40%
Malware	43	10%
Website compromise	15	-
Ransomware	36	500%
Botnet traffic	5	25%
Denial of service	0	-100%
C and C server hosting	2	100%
Suspicious network traffic	1	-86%
Attack on system	0	0%
Other	63	-20%

Focus area: Ransomware

Held to ransom

Reports of ransomware attacks over the last two years have tended to wax and wane. However, in Q4 of 2022 the numbers increased suddenly month on month, to the highest numbers CERT NZ has received in a quarter.

Year	Quarter	Incidents
2022	4	36
2022	3	6
2022	2	5
2022	1	17
2021	4	13
2021	3	18

In part, this is the effect of an attack on one company that had downstream effects on others. This is covered further below.

There is no one type of business that is more susceptible to ransomware. Reports to CERT NZ show that the attacks are spread out across a range of organisations. This could potentially be because attackers are looking for certain systems, legacy devices or exploitable vulnerabilities, rather than targeting specific businesses.

How a ransomware attack happens and what you can do to stop it

A typical ransomware attack has three parts: initial access, consolidation and preparation, and impact on target. Knowing how an attacker works can help you know what to do to stop them.

Initial Access

First an attacker needs to get access to your system, so this is also your first line of defence.

Attackers have a few ways to try and get in, but the most common ones are phishing for credentials, collecting compromised passwords found in data breaches, using software to “brute-force” guess passwords, exploiting a software vulnerability, or tricking a user into downloading malware.

The first step in defending against these types of attacks is to identify and reduce the number of possible targets. Once you have a complete list of internet-facing systems, enforcing multi-factor authentication on them and ensuring passwords are not re-used are two of the easiest and most effective security controls to prevent unauthorised access. Staff education about phishing and malware can help to mitigate some of the user-initiated access paths. But remember, even the most tech-savvy users can be fooled from time to time.

Consolidations and preparation

After gaining access, an attacker then deploys tools to take control and spread further through the system. They will attempt to access all devices and parts of your system, including back-up servers. During this stage, the attackers will be trying to hide their activities, doing things like disabling security controls and working outside of regular office hours.

Using these can prevent the attacker’s tools from running or can help you to respond rapidly if they are detected in your environment; this is key to preventing further compromise.

Multi-factor authentication is your friend again, as it’s another barrier in the way of the attacker spreading through your system.

Another mitigation is to separate administrative and critical devices from the rest of the environment and segment the network to limit the scope of an attacker. If the attacker cannot communicate with their intended targets, then their options will be greatly limited.

Impact on target

Once they are in a system and have their tools running, the attacker can do what they want. This can include stealing (exfiltrating) data to sell or hold to ransom, as well as encrypting your system and destroying backups.

Your best bet at this point is to have an incident response plan and, if possible, a robust and well-tested backup to restore to. As attackers will attempt to delete your backups, keeping them offline or disconnected from your internetconnected servers is critical.

If you discover an attacker in the early stages, you may need to move carefully as they could trigger a lockdown early to prevent you from removing or disabling their tools.

Communication will be key in this scenario. There may need to be internal and external communications and potentially disclosures to agencies such as the Office of the Privacy Commissioner.

CERT NZ has a communications framework that can be used to create a communications plan for an incident response.3 If you are sent a ransom note or any other communication by the attacker, CERT NZ recommends you do not engage with them or pay the ransom. There is no guarantee that you will get your data or systems back and the money could be used to fund further attacks and other real-world harm.

Learn more about CERT NZ’s communications framework

If you suffer an attack

In the event of an attack, you will need to implement your incident response plan. If you don’t have one, CERT NZ has resources to help create it. Reporting the incident as soon as possible to CERT NZ will mean we can help you in your response.

Creating an incident response plan

Insight: Attacks on suppliers

Crashing the third party

With businesses needing more IT and online services, there has been a rise in third-party software as a service (SaaS) and managed service providers. This can range from server hosting to the running of full IT systems remotely.

This gives organisations the ability to outsource a lot of technical work while keeping costs down. However, that makes these external services a target for attackers as it potentially gives them access to all the connected organisations.

For example, the supplier may hold data or other information from various organisations, giving the attacker a much large payoff for a single attack, not to mention downstream effects may create more disruption. In these types of incidents, the attackers will exfiltrate as much as they can from the system before destroying backups and locking it down. The more organisations involved, the more widespread the damage and there's more targets the attackers can ransom.

How to mitigate this

When looking for a supplier, ensure you go over your own certification and accreditation process with them. Ask to see incident response plans and review their controls (such as those mentioned in the Focus Area on ransomware). Larger suppliers may be less vulnerable, but no one is 100% protected. Backups are essential so, ensure that they are offsite or disconnected.

If you are affected

If you use a third-party supplier and they get hit with an attack, such as ransomware, there isn’t much you can do.

Contact CERT NZ and we can help work with the supplier. They should be in contact with you as soon as they learn of the attack and report any potential breaches or lost information. You will need to communicate with your stakeholders and possibly the Office of the Privacy Commissioner.

There is also the chance that the attackers will double down, and use the information stolen from the supplier to target its clients directly or move even further downstream to attack those connected to the clients.

Insight: Blackmail scams

Fake extortion leads to real losses

We’ve seen blackmail/extortion campaigns in Aotearoa before. Peaking in Q2 of 2020, with 482 reports which made up almost a quarter of every report to CERT NZ.

The reports for extortion have tailed off but we’re still seeing roughly one every three days (186 reports in 2022)

What is extortion and blackmail?

In a cyber context, extortion scams take the form of an email trying to trick recipients into paying money by threatening to release private information or images. Although these emails can be frightening to receive, the threats are frequently opportunistic and not credible.

Scammers use urgency and authority

These sorts of scams are designed to create stress and fear in the targets. The scammers use urgency to push these emotional buttons – for example, a short deadline for payment. They also pretend to have authority, by using technical language and talking like experts despite their claims not standing up to further scrutiny.

Reports from 2022 have included the following claims from scammers

They have hacked your email and installed malware on your computer. Possibly controlling your computer’s camera or keyboard. To add weight to the scam, the scammers can make it look as though the message has been sent from your own email address.
They have recorded video of you via your computer’s webcam. They will usually say this footage is of you in compromising positions or visiting adult websites.

Previously these sorts of scams included a password you’ve used for an online service to make their extortion seem more plausible. The scammer gets this password from data breaches of the different online service.

What to do if you receive an extortion email

If you receive an extortion email:

do not respond,
do not pay, and
report them to CERT NZ.

Reports to CERT NZ are completely confidential and are treated with care as we know these threats can be shocking to receive, even if they aren’t credible.

If the scammers included a password in the email, make sure to go to any accounts where that password is used, change it and, if possible, enable two-factor authentication.