Cybersecurity threatscape: Q3 2023

In Q3, the total number of incidents went down only slightly (by 2%) when compared to the previous quarter. Social engineering remained the top threat to individuals (92%). Cybercriminals were eager to improve their malicious methods and use new tools, including neural networks. In attacks on organizations, cybercriminals continued to use malware (in 45% of cases), but the share of encryption malware dropped from Q2 2023, with some ransomware operators now stealing data without encrypting systems. Exploitation of vulnerabilities accounted for a significant share (37%) of successful attacks on organizations. The third quarter also saw multiple cyberattacks that caused serious consequences, such as data breaches (56% of successful attacks on organizations and 61% of attacks against individuals).

Attack consequences

Just like in Q2, a data breach was the most common consequence of successful attacks on organizations (56%) and individuals (61%). Direct financial loss was the second most common consequence (35%). For organizations, this was disruption to core business functions (36%), although its share decreased by 8 percentage points from Q2 due to a decline in the use of data encryption by ransomware gangs. That being said, we recommend keeping an eye on ransomware attacks, as these tend to cause severe consequences. For example, several Sri Lankan government agencies lost access to email from May 17 till August 26 as a result of a ransomware attack. As there were no backups, some of the emails were permanently lost.

Consequences of attacks (percentage of successful attacks)
Figure 6. Consequences of attacks (percentage of successful attacks)

The top five attacks in Q3 to cause a negative impact and wide repercussions

  • In late August, due to cyberattacks on Ecuador's National Electoral Council, approximately 120,000 citizens residing abroad could not cast votes before polls closed. Voters located in Europe were the most affected. Ecuadorans who were unable to vote staged a street protest in the Spanish capital of Madrid.
  • In mid-September, Caesars Entertainment, a major hotel and entertainment company, lost an estimated $15 million to a cyberattack. The company agreed to pay a ransom to cyberextortionists who were threatening to leak a stolen customer database that contained information for a loyalty program.
  • A September cyberattack on the telecommunication service provider IFX Networks impacted Colombia, Chile, and Panama. The attackers caused damage to 762 Spanish-American companies, multiple websites and web portals became inaccessible, and government websites and online services had to suspend operations. Some of the affected organizations were Colombia's Supreme Court, the Panama America publishing house, and Chile's Government Procurement System platform. A significant volume of data on IFX Networks clients landed in the hands of cybercriminals.
  • The National Optical-Infrared Astronomy Research Laboratory NOIRLab had to suspend its Gemini North in Hawaii and Gemini South telescopes in Chile to avoid damage due to a cyberattack on August 1. The telescopes were only able to resume observations two months later, on September 29.
  • The US healthcare company Prospect Medical Holdings was attacked by the Rhysida ransomware gang in August. Hospitals were forced to shut down their IT networks to prevent the attack from spreading, revert to paper charts, and suspend several services including testing. The hospitals in Connecticut suffered the most damage. August 3, the day of the attack, saw the authorities place hospitals in Code Orange, the second highest state of emergency. Ambulances had to be rerouted to other hospitals at least 29 times, and some had to travel as far as the neighboring state of Massachusetts. Hospitals were forced to cancel almost half of scheduled procedures including critical CT scans and X-rays. The attackers insist that they stole the data of 500,000 patients and medical corporate documents.

In attacks that led to confidential data leaks, the cybercriminals most often targeted personal data (47%) and intellectual property (15%). Attacks on individuals largely aimed at stealing their account credentials (34%) and personal data (24%).

Types of data stolen (in successful attacks on organizations)
Figure 7. Types of data stolen (in successful attacks on organizations)
Тypes of data stolen (in successful attacks on individuals)
Figure 8. Тypes of data stolen (in successful attacks on individuals)

The most infamous leaks in Q3 were the following:

  • A data breach that impacted Indonesia's Immigration Directorate General and exposed the passport data of 34 million individuals. ДThe data included full names and genders, passport numbers, issuance and expiry dates, and dates of birth. The attack is attributed to the hacktivist identified as Bjorka.
  • An HCA Healthcare data breach impacted 11 million patients. The US company said the data had been stolen from an "external storage location exclusively used to automate the formatting of email messages". HCA is facing at least five class-action lawsuits.
  • A ransomware attack on Canada's Alberta Dental Service Corporation exposed the data of nearly 1.5 million of its customers. The leaked data included the personal and medical records as well as the banking information of some 7,000 members of the seniors program.
  • Human error resulted in the surnames, initials, ranks, roles, and locations of the whole Northern Ireland police force, that is, 10,000 employees of the Police Service of Northern Ireland (PSNI), being available online for three hours.
  • When publishing a bucket of open-source training data, Microsoft's research team accidentally exposed 38 TB of additional private data including backups of two employees' workstations. The copies contained confidential private data, passwords for Microsoft services, secret keys, and more than 30,000 Teams messages from 359 Microsoft employees.

InfoTo protect against cyberattacks, we recommend following our general guidelines on personal and corporate cybersecurity. In view of the events in Q3, we strongly recommend remaining vigilant online, and refraining from opening suspicious links or downloading attachments from unverified sources. Be suspicious of any urgent requests and offers that are too good to be true. It is always preferable to spend five minutes analyzing a situation than to lose your money and/or data.

Organizations should be more careful when selecting their software vendors and work on improving their vulnerability management processes. We recommend that software developers get involved in bug bounty programs and follow the coordinated vulnerability disclosure process. We also recommend using web application firewalls (WAFs) to harden the network perimeter. To protect devices against malware infection, we recommend using sandboxes that allow file behavior analysis in a virtualized environment, detecting any malicious activity, and acting in time to prevent damage to the company. Ransomware remains a serious threat, leading to the conclusion that backing up your data is a must.

Statistics

Number of attacks in 2022 and 2023 (by quarter)
Figure 9. Number of attacks in 2022 and 2023 (by quarter)

Chart

Targeted attacks accounted for 74% of successful cyberattacks

Targets of attacks (percentage of successful attacks)
Figure 10. Targets of attacks (percentage of successful attacks)

Chart

14% of successful attacks targeted individuals

Targets of attacks
Figure 11. Targets of attacks (percentage of successful attacks)
Methods of attacks (percentage of successful attacks)
Figure 12. Methods of attacks (percentage of successful attacks)
Types of malware (percentage of successful malware attacks)
Figure 13. Types of malware (percentage of successful malware attacks)
Malware distribution methods
Figure 14. Malware distribution methods in successful attacks on organizations
Methods of malware distribution in successful attacks on individuals
Figure 15. Methods of malware distribution in successful attacks on individuals
Target OS in malware attacks (percentage of successful attacks)
Figure 16. Target OS in malware attacks (percentage of successful attacks)

 

About the report

This report contains information on current global information security threats based on Positive Technologies' own expertise, investigations, and reputable sources.

We estimate that most cyberattacks are not made public due to reputational risks. As a consequence, even companies specializing in incident investigation and analysis of hacker group activity are unable to calculate the precise number of threats. Our research is aimed at companies and ordinary individuals who care about the state of information security to the key motives and methods of cyberattacks, as well as highlighting the main trends in the changing cyberthreat landscape.

This report considers each mass attack (for example, phishing emails sent to multiple addresses) as one incident, not several. For explanations of terms used in this report, please refer to the glossary on the Positive Technologies.

Get in touch

Fill in the form and our specialists
will contact you shortly