Threat Lab

The managed service provider (MSP) industry is booming with opportunities. At the same time, MSPs face the challenge of balancing customer satisfaction with profitability, making strategic decisions more important than ever. For 35% of MSPs, building cyber resiliency for customers is a top strategic priority, but that goal often runs up against resource constraints and rising operational costs.[i] To stay competitive, MSPs are focusing on improving operational efficiency (35%) and keeping costs under control (33%).[ii]

One of the smartest ways to tackle these strategic goals is by partnering with OpenText to deliver managed detection and response (MDR) services. This partnership empowers MSPs to offer a cutting-edge, fully managed detection and response service, taking the weight off operational costs and simplifying the complexity of building and managing an in-house MDR solution.

Here are five ways OpenText MDR helps MSPs overcome their biggest challenges:

1. Filling the security staff resource and skills gap

Staffing can be a perpetual challenge for MSPs, particularly when it comes to hiring and retaining skilled cybersecurity professionals. With a global shortage of 4.8 million cybersecurity experts, this issue is only becoming more pressing. MSPs feel the strain in several key areas, including:

• Managing an overwhelming volume of alerts with a limited team
• Cultivating the advanced skills needed to thoroughly investigate and prioritize threats
• Attracting and retaining top security talent to close skills gaps and support business growth

OpenText MDR tackles this challenge for MSPs head-on by providing you with a fully managed or co-managed MDR partnership. With OpenText MDR, MSPs can access 24/7/365 security expertise and continuous threat monitoring without the cost or complexity of building an in-house SOC. This not only eases the pressure on your internal teams but ensures a high-level of security coverage for your customers at all times.

2. Streamlining alert management

Detecting advanced threats requires a sophisticated approach to monitoring a customer’s attack surface. This is where SIEMs come in—essential for correlating data and identifying threats. However, SIEMs can be complex to configure, manage, and tune, which can lead to a high volume of false positives. For MSPs with limited resources, this flood of irrelevant alerts can overwhelm teams and drain operational efficiency.

OpenText MDR solves this by leveraging advanced threat intelligence to correlate security logs and reduce false positives, all while managing the SIEM and monitoring alerts for you. By continuously prioritizing critical threats, our experts handle the complexity of alert management, allowing MSPs to focus on what matters most—securing their customers—without the burden of filtering through a flood of false alarms.

3. Accelerating incident response

With a flood of alerts constantly coming in and the need to pivot between multiple consoles to investigate, MSP security teams often struggle with slow, time-consuming incident response. The pressure to act quickly is high, as swift action is essential to prevent the disastrous outcomes of a breach. However, many teams find themselves bogged down, bouncing between disparate tools and struggling to identify and respond to threats in real-time.

OpenText MDR addresses this challenge with fast, proactive monitoring and continuous threat hunting to detect suspicious activity early. Our dedicated experts streamline incident response by quickly identifying threats and escalating them within 15 minutes, ensuring MSPs can act fast and minimize the impact of potential breaches.

4. Simplifying security management across complex environments

Managing a customer’s complex environment can be challenging for MSPs. With diverse security tools, large volumes of data, and multi-environment deployments, the complexity of managing each unique environment can overwhelm MSP teams, stretching resources thin and hindering effective security management. Delivering cybersecurity services that support your diverse customer environments requires a solution that integrates seamlessly and simplifies management without adding to the burden.

OpenText MDR makes it easy to support your customer environments by offering a fully integrated solution that seamlessly supports your MSP partner and tools ecosystem. With AI-driven automation, OpenText MDR processes vast amounts of data quickly, integrating effortlessly with over 500 tools and services. Its lightweight agent ensures easy deployment across multiple environments, providing end-to-end visibility through a single dashboard. This not only streamlines security management but also helps MSPs leverage their existing investments while benefiting from expert human analysts guiding the process.

5. Driving revenue growth without barriers to entry

For MSPs, staying competitive and standing out in your region requires offering innovative solutions that meet customer needs without the complexity and barriers often associated with new vendor partnerships. Having an MDR offering can be a key driver for growth, but the challenge lies in finding an MDR vendor that has both a cutting-edge solution and flexible licensing, without the constraints of long-term contracts or rigid terms.
OpenText MDR addresses this by offering a subscription-based model with no minimum contract, making it easy to integrate into your existing service offerings. MSPs can access additional services like penetration testing, vulnerability management, and custom incident response plans as needed, with simple, integrated billing through OpenText’s Secure Cloud Platform. This flexibility allows you to scale your MSPs cybersecurity services as your business grows.

Discover how OpenText MDR can empower your MSP to overcome challenges and drive growth.

[i] Datto 2024 Global State of the MSP Report

[ii] Datto 2024 Global State of the MSP Report

It’s an exciting time to be a managed service provider (MSP). More than ever, small and medium businesses (SMBs) are looking to MSPs as trusted advisors to help safeguard them from today’s growing cyber threats. One of the services in high demand right now? Managed detection and response (MDR). When asked about their biggest growth drivers, MSPs cite addressing clients’ cybersecurity concerns and awareness as the top new-business drivers (54%).¹

For MSPs, adding MDR to your lineup can create new revenue streams while enhancing the value you bring to your clients. By offering OpenText MDR to your MSP clients, you gain access to skilled security experts and advanced technology infrastructure—without the complexity and cost of building it all in-house.

Here’s why more MSPs are partnering with OpenText to power their MDR security services:

1. Seamless integration with your existing tools

One of the greatest advantages of choosing OpenText MDR is its compatibility with your existing tools. OpenText MDR easily integrates with over 500 third-party tools, using APIs so you can add MDR services to your offerings without disrupting your current technology stack.

This flexibility also extends to popular professional services automation (PSA) tools, allowing for smooth incident ticketing and vulnerability management within your established workflows. With OpenText MDR, you can confidently grow your service portfolio while keeping your partner ecosystem intact.

2. Grow your revenue with flexible, hassle-free licensing

With cybersecurity top of mind, MSPs are seeing a surge in demand for security services. OpenText MDR helps you capitalize on this opportunity with a subscription-based model designed to grow with you—risk-free.

There are no long-term contracts, hidden fees, or minimums—just the freedom to scale your MDR services month-to-month, at your own pace, and based on your clients’ evolving needs. This flexibility lets you capture new revenue streams without overextending your resources.

3. Enhancing EDR with SIEM and SOAR capabilities

Effective MDR requires more than simply monitoring a client’s endpoint detection and response (EDR) solution—it demands a comprehensive view of the entire attack surface. OpenText MDR delivers this by enhancing your client’s EDR with advanced SIEM and SOAR capabilities.

The platform features real-time monitoring—integrated SIEM and SOAR capabilities—enabling rapid threat detection and automated response across your clients’ environments. This advanced approach safeguards your clients from evolving threats on all fronts—from endpoint to cloud.

4. Automation combined with human expertise

OpenText MDR brings together the speed of automation and the skill of experienced security analysts. This blend ensures that threats are detected quickly, incidents are prioritized with care, and responses are expertly managed around the clock, every day of the year. You get the best of both worlds—cutting-edge technology and dedicated human oversight that augments your MSP team.

With OpenText MDR, you can confidently offer clients a proactive, always-on defense against evolving threats—without the need to build up your own in-house security team.

5. Rapid incident response and proactive threat hunting

A speedy response is crucial to stopping adversaries in their tracks before they gain a foothold. MSPs can count on OpenText’s rapid incident response support, complete with dedicated escalation paths for high-priority threats, ensuring swift action when it matters most. You have the flexibility to choose whether you want the OpenText MDR team to completely manage threat response, or opt for co-managed support, where your team takes the lead with OpenText offering expert backup and resources.

OpenText MDR also delivers continuous, proactive threat hunting to identify and neutralize risks before they can affect client environments. This powerful combination of active threat hunting and fast response equips MSPs to provide clients with a robust, preemptive defense against emerging threats.

A speedy response is crucial to stopping adversaries in their tracks before they gain a foothold. MSPs can count on OpenText’s rapid incident response support, complete with dedicated escalation paths for high-priority threats, ensuring swift action when it matters most. You have the flexibility to choose whether you want the OpenText MDR team to completely manage threat response, or opt for co-managed support, where your team takes the lead with OpenText offering expert backup and resources.

OpenText MDR also delivers continuous, proactive threat hunting to identify and neutralize risks before they can affect client environments. This powerful combination of active threat hunting and fast response equips MSPs to provide clients with a robust, preemptive defense against emerging threats.

Stand out and succeed with OpenText MDR

By adding OpenText MDR to your portfolio, you can differentiate yourself in the market, offering SMBs a level of protection that goes above and beyond the competition. With 24x7x365 coverage, over 500 third-party integrations, SIEM and SOAR at no additional cost , and proven value, you’ll be able to deliver superior MDR service that not only meets but exceeds customer expectations.

Ready to have a conversation and learn more?

With the rise of online scams and privacy risks, virtual private networks (VPNs) are becoming more popular for day-to-day use. Or at least I feel like they are based on the number of ads I hear for them on my favorite podcasts.

So maybe you’ve heard of VPNs but aren’t actually sure what they are. Simply put, a VPN creates a safe, anonymous pathway for the data you send and receive over a Wi-Fi network, allowing you to browse anonymously and access content as if you were in a different location.

Maybe you’ve used VPNs as a remote worker to access resources and applications for your job, or as a student to connect to your university network. Do you really need a VPN for personal use? The short answer—absolutely! Keep reading for the long answer and for tips on choosing the right VPN.

How do VPNs work?

Essentially, VPNs create a secure tunnel for your data. The five core components of a VPN are:

1. Encryption: The conversion of information into a coded format that can only be read by someone who has the decryption key. It ensures that data remains secure and private during transmission or storage.
2. VPN servers: Usually located all over the world, VPN servers act as intermediaries between your device and the internet and maintain your privacy by masking your IP address and location.
3. Kill switch: Blocks your device’s internet access if the VPN connection drops. This way, the VPN app makes sure you’re always protected.
4. Split tunneling: Allows you to choose which internet traffic goes through the VPN (with encryption) and which goes directly to the internet.
5. VPN protocols: Transmits your data according to protocols like OpenVPN, IKEv2, and WireGuard. Each cover different use cases like streaming or gaming or are required for certain types of devices.

Why use a VPN?

Maybe you already have other personal cybersecurity tools for personal user and think you don’t need a VPN. Consider the following and see if you still feel that way:

Privacy protection

Because a VPN creates a secure tunnel for your data, you don’t have to worry about bad actors peeping in on your activity and private information. This is especially important when using public Wi-Fi at coffee shops, airports, malls or hotels, where hackers can easily overcome public Wi-Fi security protocols to gain access to your device.

Antivirus augmentation

Even if you already have antivirus software, using a VPN enhances your personal cybersecurity.
Personal privacy:

• Antivirus software: Primarily protects your device from malware, viruses, and other malicious software.
• VPN: Encrypts your internet connection, hiding your online activities from ISPs, hackers, and even government surveillance. Keeps your browsing history and personal data private and anonymous.

Secure public Wi-Fi use:

• Antivirus software: Can detect and block malicious files or websites, but it doesn’t secure your internet connection.
• VPN: Protects your data on public Wi-Fi networks, which are often unsecured and a hotspot for hackers. A VPN encrypts your connection, making it much harder for anyone to intercept your data.

Accessing restricted content

I have a friend who loves British television but can’t always access it due to living in America. So she uses a VPN to set the United Kingdom as her virtual location and then watches all the BBC murder mysteries she wants.

This capability is extremely useful if you’re someone who travels a lot. For example, if you find yourself in a country with strict censorship laws, a VPN can help you access your usual content—even if it is restricted.

Which VPN should you choose?

Consider the following when researching VPNs:

• Connection speed
• Unlimited data and bandwidth
• Number and location of servers across the globe
• No-log policy*
• Security features and protocols
• Ease of use
• Brand reputation and customer support

While some VPNs may be free, they often come with limited performance, data caps, and lower security and log standards.

What steps should you take next?

Cybersecurity is only going to get more important as technology—and cyberthreats—advance. To protect your private, sensitive data, you’ll need all the tools at your disposal to keep out criminals. Add a VPN such as Webroot™ Secure VPN to your arsenal of cybersecurity tools to browse the internet safely and privately.

*A no-log policy means that the provider doesn’t keep any records of your online activities, ensuring your privacy and anonymity. This policy protects you from tracking, reduces the risk of data breaches, and prevents third-party access to your information. It also builds trust and gives you peace of mind, knowing your online activities are not being recorded or shared.

Steam the Webinar on demand HERE

As we look back on the cybersecurity landscape of 2024, it’s clear that the world of digital threats continues to evolve at an alarming pace in parallel with AI. This year has seen ransomware groups adapt and innovate, pushing the boundaries of their malicious capabilities and evasiveness from law enforcement. In our annual “Nastiest Malware” report, now in its sixth year, we’ve observed a steady increase in both the number and sophistication of malware attacks. The ransomware sector, in particular, has witnessed the emergence of “business models,” with ransomware-as-a-service (RaaS) dominating the scene. Elite ransomware authors have concluded that profit sharing and risk mitigation are key contributors to their consistent success and evasion of authorities.

The saga of LockBit in 2024 exemplifies the resilience and adaptability of these cybercriminal groups. Despite a major law enforcement operation in February, dubbed “Operation Cronos,” which saw the FBI and international partners seize LockBit’s infrastructure and obtain over 7,000 decryption keys, the group managed to resurface within days. This cat-and-mouse game between LockBit and law enforcement agencies has continued throughout the year, with the group’s leader even taunting the FBI, claiming that their efforts only make LockBit stronger. The LockBit story underscores a crucial point: while law enforcement operations can disrupt cybercriminal activities, they often fall short of delivering a knockout blow. These groups have become adept at rebuilding their infrastructure, rebranding when necessary, and continuing their operations with minimal downtime.

As we detail our analysis of the six most notorious ransomware and malware groups that have dominated headlines in 2024, it’s important to note that the threat landscape extends beyond just these actors. The rise of AI-driven phishing and social engineering, increased targeting of critical infrastructure, and the emergence of more sophisticated fileless malware are all trends that have shaped the cybersecurity battlefield this year.

In this report, we’ll explore how these groups have evolved, their most significant attacks, and the broader implications for cybersecurity. We’ll also provide updated survival tips for both businesses and individual users, reflecting the ever-changing nature of these threats.

Ransomware

Over the past decade, ransomware has established itself as the pinnacle of cybercriminal exploits. It is the most successful and lucrative avenue for monetizing a breach of a victim. Every year we see more and more data stolen and higher ransom demands dominating headlines. Each ransomware group on our Nastiest Malware list utilizes the double-extortion method where the data stolen is leveraged for leak potential on dark web leak sites. The impending damage to brand and reputation that comes with the public disclosure of a breach are massive threats to companies of any size. Not to mention the impending regulatory fines that come with the breach. This strategy has shown it’s resilience over the past few years since it became mainstream and it seems to be as robust as ever. Let’s take a look at what the payment numbers look like so far in 2024.

Source: Coveware

We’ve seen a drop-off from the highs last year – fueled by Cl0p ransomware group making over $100 Million in a few months in late 2023. But when we zoom out you can see that it will be going up over time. This time next year we anticipate the amounts to be higher than what they are now. Some of this will be fueled by inflation, some will be an increase in effectiveness in tactics, and some by the anticipated 2025 “bull run” price spike in crypto – the only payment method these criminals accept.

Looking at the payment resolution rates – meaning the percentage of people that end up paying the ransom, we can see a slight increase during this year. Zooming out the trend does indicate an overall decline which is good news and reflects that the industry is taking serious precautions in their security posture. We expect that this slight increase is only temporary and will continue the trend of decreasing for next year. 

One nasty change this year is the increase of ransomware attacks on smaller sized businesses. The market share of ransomware attacks on business with under 100 employees is now almost 40%. While the media headlines of record breaking ransoms against fortune 500 companies will always take center stage, the small to mid market has always been the bread and butter for cybercriminals. The amount of effort and return on investment of time is too good for criminals not to be attracted to these easier and weaker targets. Now let’s take a look at this year’s Nastiest Malware.

LockBit: The Resilient Threat

One of the most notorious ransomware groups, LockBit, faced significant challenges and disruptions in 2024 due to coordinated international law enforcement efforts. The year began with “Operation Cronos,” a major strike against LockBit’s infrastructure in February. Led by the UK’s National Crime Agency (NCA) and involving agencies from multiple countries, including the FBI, this operation resulted in the seizure of LockBit’s leak sites and the exposure of information about nearly 200 affiliates. A pivotal moment came when the FBI obtained over 7,000 decryption keys, allowing victims to unlock their encrypted data for free. This dealt a severe blow to LockBit’s operations and credibility – remember that most of the success and money is from the affiliates that choose thier ransomware payload over another’s group so credibility and trust are paramount in this criminals scene.

Despite these setbacks, LockBit attempted to maintain its operations, quickly adapting by changing encryption methods and shifting its leak site strategy. However, law enforcement continued to apply pressure throughout the year. In May, authorities revealed the identity of LockBit’s alleged mastermind, Dmitry Yuryevich Khoroshev, and offered a $10 Million reward for information leading to his arrest. The culmination of these efforts came in October when law enforcement agencies announced additional arrests and disruptions. Four individuals connected to LockBit were arrested, including a major developer and two affiliates. Notably, Aleksandr Ryzhenkov, linked to both LockBit and the infamous Evil Corp group, was unmasked and sanctioned. These actions, part of the ongoing Operation Cronos, significantly impacted LockBit’s operations, leading to a noticeable decrease in their attack frequency and causing distrust within the cybercriminal community.

Despite LockBit’s attempts to maintain its fearsome reputation, including false claims of attacks, the group’s activities were impacted throughout 2024, marking a significant victory for global cybersecurity efforts. However, LockBit is still a major player in the RaaS scene and the leader and his affiliates are still making millions in ransoms. LockBit has proven its resilience in the face of law enforcement efforts, presenting the group’s adaptability and persistence. The leader has boasted that he loves the FBI and that they only make his group stronger, and he wants to hit one million businesses before retirement. This is a stark contrast from most ransomware groups when hit by law enforcement as they will quickly retire the brand and repivot to another. This RaaS has been on the Nastiest Malware for over three years maintaining its status as a top contender in the Ransomware scene in 2024. 

Akira: The Healthcare Menace

The Akira ransomware group was first observed in March 2023 and immediately became one of the most formidable threats in the threat landscape. By January 2024, the group had impacted over 250 organizations and claimed approximately $42 million in ransomware proceeds. Akira’s rapid rise to the top was marked by its versatility and constant evolution of tactics. In 2024, Akira expanded its capabilities significantly. Initially focused on Windows systems, the group deployed a Linux variant targeting VMware ESXi virtual machines in April. Throughout the year, Akira demonstrated a pattern of swift adaptation to new vulnerabilities. They actively exploited several critical vulnerabilities, including SonicWall SonicOS, Cisco Adaptive Security Appliance (ASA), and FortiClientEMS software. These exploits allowed Akira to gain initial access, escalate privileges, and move laterally within compromised networks.

A notable shift in Akira’s tactics occurred in early 2024 when they appeared to sideline encryption tactics, focusing primarily on data exfiltration. However, by September 2024, there were indications of a potential return to previous tactics using Windows and Linux payloads written in C++. This adaptability was further evidenced in a June 2024 attack on a Latin American airline, where Akira operators exploited vulnerable services to  deploy ransomware and exfiltrate data.

Akira’s victims spanned a wide range of sectors, with a particular focus on manufacturing, professional services, healthcare, and critical infrastructure. The group’s success was attributed to its constant evolution, sophisticated attack methods, and the employment of double-extortion tactics. As of 2024, Akira had solidified its position as one of the most prevalent and dangerous ransomware operations in the cybersecurity threat landscape.

RansomHub: The High-Profile Attacker

RansomHub emerged as a formidable new player in the ransomware landscape in February 2024, quickly establishing itself as one of the most prolific and dangerous ransomware groups. Operating on a RaaS model, RansomHub attracted high-profile affiliates from other prominent groups like BlackCat/ALPHV following their FBI takedown in December 2023. This is likely due to its attractive payment structure where affiliates receive up to 90% of the ransom – compared to around 30-50% with other groups.

By August 2024, RansomHub had breached at least 210 victims across various critical U.S. infrastructure sectors, including healthcare, government services, financial services, and critical manufacturing. Notable attacks included breaches of Planned Parenthood, the Rite Aid drugstore chain, Christie’s auction house, and Frontier Communications, with the latter resulting in the exposure of personal information of over 750,000 customers. RansomHub’s tactics evolved throughout the year, employing sophisticated methods such as exploiting various software vulnerabilities, using intermittent encryption to speed up attacks, and leveraging double extortion techniques. The group’s data leak site became a significant threat, with stolen data being published for 3-90 days if ransom demands were not met.

The attack on Planned Parenthood not only demonstrated RansomHub’s capability to breach highly sensitive networks but also highlighted their willingness to target organizations with high reputational risks. This sparked widespread concern and discussions on cybersecurity measures within nonprofit organizations. By October 2024, RansomHub had overtaken LockBit as the most prolific ransomware group in terms of claimed successful attacks, solidifying its position as a major threat in the cybersecurity landscape.

Dark Angels: The Whaling Experts

Dark Angels emerged as one of the most formidable ransomware threats in 2024, gaining notoriety for their highly targeted “big game hunting” approach and record-breaking ransom demands. The group, which has been active since 2022, made headlines in early 2024 when they reportedly received a staggering $75 million ransom payment from a Fortune 50 company. This payment would be nearly double the previous record of $40 million paid by CNA Financial in 2021.The group’s modus operandi involves targeting a small number of high-value organizations, often exfiltrating massive amounts of data (typically 10-100 terabytes for large businesses) before considering encryption. This strategy allows Dark Angels to maintain a low profile while maximizing their profits.

In 2024, they continued to evolve their tactics, switching from a Babuk-ESXi-based ransomware to a variant of Ragnar Locker. Notable attacks attributed to Dark Angels in 2024 included a breach of a high-profile media company, where they stole proprietary information and engaged in lengthy negotiations before the ransom was paid. The group’s data leak site, named “Dunghill Leak,” is used to pressure victims into paying, though the group often prefers to avoid public attention. Dark Angels’ success in 2024, particularly the record-breaking ransom payment, has raised concerns that their tactics may be emulated by other cybercriminal groups, potentially leading to an increase in highly targeted, high-value ransomware attacks across various sectors.

RedLine: The Credential Thief

Not all of our Nastiest Malware are ransomware groups and RedLine Stealer has become one of the most prominent threats in 2024, particularly due to its capability to steal credentials and sensitive data across a wide array of sectors. Throughout 2024, RedLine demonstrated its effectiveness by stealing over 170 million passwords in just a six-month period, highlighting its massive impact. The malware’s capabilities expanded to include stealing not only passwords but also credit card details, cryptocurrency wallets, and browser data. Its adaptability and frequent updates allowed it to evade many security measures, making it a persistent threat across various sectors.

RedLine’s distribution methods remained diverse, with phishing emails and malicious websites being the primary vectors. The malware’s operators continued to refine their tactics, often disguising RedLine as legitimate software updates or enticing downloads. This approach allowed them to bypass traditional security measures and infect a large number of systems. The impact of RedLine extended beyond individual users to affect major corporations and critical infrastructure. Several high-profile breaches attributed to RedLine in 2024 resulted in significant financial losses and reputational damage for the affected organizations. 

Breaking news!
In late October 2024 – RedLine suffered a takedown from a coordinated international law enforcement operation dubbed “Operation Magnus.” Led by the Dutch National Police and supported by agencies including the FBI, UK’s National Crime Agency, the operation successfully disrupted RedLine’s infrastructure and operations. The authorities gained full access to RedLine’s servers, obtaining crucial data including usernames, passwords, IP addresses, and even the source code of the malware. This breakthrough allowed law enforcement to retrieve a database of thousands of RedLine clients, paving the way for further investigations and potential legal actions against cybercriminals who used the malware. The U.S. Department of Justice charged Maxim Rudometov, a Russian national, as the suspected developer and leader of the RedLine malware operation. If convicted, Rudometov faces up to 35 years in prison on charges including access device fraud, conspiracy to commit computer intrusion, and money laundering.

Only time will tell if this seizure of assets is enough to shutdown the operations of RedLine and prevent them from bouncing back like we’ve seen time and time again from other resilient groups on this list. 

Play Ransomware: The Versatile Threat

Play ransomware continued to be a significant threat in the cybersecurity landscape throughout 2024. The group, which first appeared in 2022, maintained its position as one of the most active ransomware operations, consistently ranking among the top threat actors. In 2024 a notable shift occurred when the group transitioned from its previous double-extortion tactics to specifically targeting ESXi environments. This change in focus allowed Play to exploit vulnerabilities in virtual machine infrastructures, increasing the impact of their attacks.

A significant attack attributed to Play Ransomware targeted a major utility provider, resulting in widespread service disruptions and raising concerns about critical infrastructure vulnerabilities. The attack began with the exploitation of unpatched FortiOS vulnerabilities in the company’s VPN infrastructure, allowing initial access to the network. From there, the attackers leveraged exposed RDP services to move laterally within the network, eventually gaining the access needed to deploy their ransomware payload.

The group’s use of intermittent encryption continued to be a defining characteristic, allowing them to evade many endpoint security solutions while still rendering files inaccessible to victims. Play’s attacks were particularly damaging in the IT services sector, suggesting a strategic focus on organizations that could lead to supply chain impacts.

AI-Driven Phishing and Social Engineering: 

• The use of AI and machine learning in crafting phishing emails has made these lures more convincing and harder to detect. Cybercriminals are leveraging AI to personalize attacks, increasing their success rates 

Targeting of Critical Infrastructure: 

• There has been a noticeable increase in attacks targeting critical infrastructure, including utilities and healthcare sectors, raising concerns about national security and public safety 

Fileless Malware: 

• Fileless attacks aren’t new, and neither is bypassing security protections but there has been an increase in harder to detect kill chains, more sophisticated attacks, more complex persistence, that are more effective at bypassing security than ever.   

New Malware Language: 

• Malware written in Golang continues to trend in both scale and complexity 

Businesses: 

• Lock down Remote Desktop Protocols (RDP) – this infiltration tactic has been around for a while, but it’s still one of the top infection vectors! 
• Enhance Employee Training: Go beyond basic awareness. Implement regular, interactive cybersecurity simulations and scenario-based training. 
• PATCH OR DIE! 
• Implement a Multi-layered security and defense in depth posture.  
• Adopt a Comprehensive Backup Strategy: Implement the 3-2-1 backup rule with immutable backups to protect against ransomware attacks. 
• Develop and Test Incident Response Plans: Create, regularly update, and practice cybersecurity incident response plans. 

Individual Users: 

• Use Password Managers: Employ a reputable password manager to create and store strong, unique passwords for all accounts – consider passphrases. 
• Enable Multi-Factor Authentication (MFA): Activate MFA on all accounts that offer it, preferably using authenticator apps or hardware keys. 
• Keep Software Updated: Enable automatic updates for your operating system, applications, and security software. 
• Be Cautious with Smart Devices: Secure your IoT devices by changing default passwords and keeping firmware updated. 
• Practice Safe Social Media: Be cautious about the personal information you share on social media platforms. 
• Use Virtual Private Networks (VPNs): Employ a reliable VPN service, especially when using public Wi-Fi networks. 

Download the infographic HERE

In today’s world, both small businesses and everyday consumers face a growing number of cyber threats. From ransomware attacks to phishing scams, hackers are becoming more sophisticated. OpenText’s 2024 Threat Hunter Perspective sheds light on what’s coming next and how to protect yourself. Whether you’re running a small business or managing personal data at home, here’s what you need to know.

Nation-states are teaming up with cybercrime gangs

Cybercrime is no longer just about lone hackers. Now, nation-states like Russia and China are working with organized cybercrime groups to launch highly targeted attacks on businesses, governments, and even individuals.

• Russia has been particularly active, coordinating with groups like Killnet to attack critical infrastructure in countries supporting Ukraine.
• China is focusing on its political goals in the South China Sea, often collaborating with cybercrime rings like Storm-0558.

For SMBs: Be aware that even smaller businesses can be collateral damage in nation-state cyber wars, especially if you’re part of a critical supply chain. Strengthen your security measures to avoid becoming an easy target.

For consumers: Stay alert to potential phishing attacks or scams related to global events. Hackers often exploit moments of political tension or publicized aid efforts.

Timing is everything for hackers

One of the key insights from the report is how hackers choose the most disruptive moments to strike. Whether it’s during an election, the holiday season, a big sporting event, or a major business transaction, cybercriminals wait for the right moment to maximize damage.

For example, businesses supporting Ukraine saw a significant increase in attacks within 24-48 hours of announcing aid. This shows that hackers pay attention to the news—and use it to time their attacks for maximum chaos.

For SMBs: Be especially vigilant during peak business times or important events, like product launches, financial closings, or holiday seasons. These are moments when your business may be more vulnerable due to distractions or heavy workloads.

For consumers: During holidays or big events (like the Super Bowl or Black Friday), be cautious of unexpected emails, texts, or promotions. Scammers love to take advantage of busy times to trick people into clicking malicious links.

Top cyber threats you need to know about in 2024

The OpenText report highlights some of the most dangerous cyber threats we’ll be facing this year. Whether you run a small business or manage your own personal data, these threats are ones to watch out for:

• Killnet and Storm0558 (nation-state-linked groups)
• Akira and Black Basta (ransomware gangs targeting businesses of all sizes)

These groups are known for launching ransomware attacks, where they lock down your systems or steal data, demanding a hefty ransom to get it back.

For SMBs: Invest in ransomware prevention and always back up your data. Having regular backups means you can recover without having to pay a ransom.

For consumers: Keep personal backups of important files (photos, documents, etc.) on an external drive or in the cloud. That way, even if your devices get infected, you won’t lose everything.

What to expect this fall: U.S. election and beyond

With the U.S. presidential election in fall 2024, the cyber landscape is expected to get even more dangerous. Cybercriminals and nation-states alike will likely target key services and use misinformation to influence the public.

In addition, the report predicts an increase in attacks on critical infrastructure—things like power grids, water systems, and hospitals—throughout 2024, as part of the growing cyber arms race.

For SMBs: Be prepared for increased cyber activity around major political events, as hackers may use the chaos to launch broader attacks. Ensure your cybersecurity measures are updated and your employees are trained to spot phishing attempts.

For consumers: Be skeptical of political content online, especially as we approach the election. Deepfake videos and fake news are expected to rise, making it harder to tell fact from fiction.

AI: Both a help and a threat

AI is playing a bigger role in cybersecurity, but it’s also giving hackers new tools. Cybercriminals are using AI to create more convincing scams, such as deepfake videos and phishing emails that are harder to detect. But at the same time, AI can help businesses defend themselves by detecting threats faster and automating security responses.

For SMBs: AI tools can help boost your cybersecurity efforts by automating threat detection, but remember that AI is not a fix-all solution. Human oversight is still crucial to ensure your defenses are robust.

For consumers: Be wary of AI-driven scams. If you receive a message, video, or email that seems suspicious—even if it looks real—double-check before sharing any information or clicking on a link.

Practical security tips for SMBs and consumers

The report emphasizes simple yet effective security measures that can protect both businesses and individuals from cyber threats.

• Keep software updated: Whether you’re running a business or just protecting personal devices, always update your software and security tools. Patches often fix vulnerabilities that hackers could exploit.
• Use strong, unique passwords: Weak or reused passwords are an easy way in for cybercriminals. Use a password manager to create and store strong passwords.
• Enable two-factor authentication (MFA): For added protection, enable two-factor authentication on your accounts. This ensures that even if a hacker gets your password, they can’t access your account without a second step.
• Train employees on security basics: If you run a business, make sure your team is aware of common threats like phishing emails and knows how to report suspicious activity.

For SMBs: Consider a cybersecurity audit to identify any weaknesses in your system, and make sure your backup plans are up to date. Cyber insurance might also be worth looking into as an additional safety net.

For consumers: Keep an eye out for phishing scams, especially during high-risk times like holidays or after major news events. When in doubt, verify the source before clicking.

Download your copy of OpenText’s 2024 Threat Hunter Perspective today