Threatonomics Newsletter: January in Review

Welcome to the new year! In this issue, we explore the cyber trends and insights from the past month to better understand the global cyber threat landscape ahead of us in 2024.

?? Insights on Cyber Resilience

• Do you Need Human Brains to Make AI Useful in Cybersecurity? Senior Director of Cyber Resilience Rob Brown says yes. Read about the indispensable role of humans in AI-driven Cyber Risk Management and how Resilience leverages our humans-in-the-loop.

• Mastering Cyber Resilience: Continued Education for Brokers on Effective Cyber Risk Management. Are you a broker looking to expand your understanding of cyber resilience in practice? In 2024, Resilience experts will offer several courses to help brokers better understand their clients’ risk and help them foster resilience against material losses.?

• The Top Three Trends on Cyber Resilience from The World Economic Forum. The World Economic Forum recently released its Global Cybersecurity Outlook for 2024, highlighting major findings in the world of cyber. Learn about these findings and their relevance to building resilience in 2024.??

?? ICYMI - What's New in Cybersecurity and Insurance

Highlights in Cyber Insurance

• Looking Ahead: Cyber Liability Insurance Concerns in 2024. This report by Woodruff-Sawyer covers hot topic issues that will be prevalent in 2024. The rise of war exclusions in policies, new SEC rules, the impact of AI, and technology in supply chain risk management are highlighted, as well as an overall prediction that overall cyber risk will increase in 2024 with a considerably focused concern on the state of ransomware.?

• Cyber Insurance Market to be Worth Over $90bn by 2033: An analysis by Market.Us predicts that the cyber insurance market will continue to grow at a rate of 22.3% CAGR. End-of-year 2023 calculations have led analysts to change their projected 2024 valuation of the industry from $12.1 to $14.8 billion due to trends in third-party and large business coverage.?

• Identifying real cyber systemic risk still ‘biggest insurance challenge’: Insurance continues to struggle to identify and predict systemic risk and gather information around these scenarios. This piece identifies the critical need for more data to clarify “real” threats versus ones that are unlikely to occur. Meike R?llecke, head of cyber and financial lines at HDI Global SE will deliver a panel on February 8th titled “Rethink cyber systemic risk—Approaches to break down obstacles hindering growth and sustainability in the cyber insurance marketplace” at the Intelligent Insurer’s Cyber Risk Insurance Innovation Europe 2024 on this critical need in the cyber re/insurance industry.?

• The World Economic Forum’s Global Cybersecurity Outlook 2024. This report studies the risks of “looming cyber inequity amid a rapidly evolving tech landscape” and the criticality of public-private communications in managing and understanding cyber risks. It highlights the disparities between cyber and executive communications and improvements that will be necessary for organizations to build cyber resilience in 2024.?

Highlights in Cybersecurity

• Sealed Indictment Shows Case Against Hacker Behind Massive T-Mobile Data Breach. John Erin Binns, a US citizen in Turkey, claimed responsibility for the 2021 T-Mobile hack; the indictment is for hacking, money laundering, identity theft, and wire fraud offenses.

• CISA warns agencies of fourth flaw used in Triangulation spyware attacks. Cybersecurity and Infrastructure Security Agency (CISA) added several vulnerabilities to its Known Exploited Vulnerabilities (KEV) list, including CVE-2023-41990, used in the ‘Operation Triangulation’ campaign where attackers bypassed security measures in iPhones belonging to several targets–primarily journalists and government employees–around the world.??

• Hackers can infect network-connected wrenches to install ransomware. The more items that people connect to the internet, the larger the threat landscape becomes; for example, threat actors can exploit 23 vulnerabilities in the Bosch Rexroth Handheld Nutrunner NXA015S-36V-B to install malware, including ransomware, Dr1llcrypt.

• Fake 401K year-end statements used to steal corporate credentials. Threat actors used bogus 401K notifications and QR codes for Human Resource-based campaigns.??

?? Threat Intel - Stay Informed on The Latest Cyber Threats

• Financially motivated threat actors misusing App Installer. During the final quarter of 2023, Microsoft Threat Intelligence observed financially motivated threat actors leveraging the ms-app installer URI scheme (App Installer) to distribute malware. In response, Microsoft turned off the ms-appinstaller protocol handler by default.

• Amsterdam arrest leads to Babuk Tortilla ransomware decryptor. A joint operation by Avast, Cisco Talos, and the Dutch Government resulted in an arrest and the availability of the decryptor key for the Babuk variant ‘Tortilla.’

• Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN. Probable state-backed attackers are chaining together two Zero-Day vulnerabilities to compromise Ivanti devices, pivot into networks, and exfiltrate data.

• Follow-On Extortion Campaign Targeting Victims of Akira and Royal Ransomware. Artic Wolf Labs–an incident response company–investigated cases where a threat actor targeted Akira and Royal ransomware victims for follow-on extortion attempts.

Thank you for reading. Before you go...

Subscribe so you don’t miss our next issue. For more trends and insights from Cyber Resilience experts, follow our LinkedIn page or visit our website for weekly blog posts, videos, and more!

?