Ransomware as a Service (RaaS) threat emerges

A new report from Nozomi Networks identifies emergence of Ransomware as a Service (RaaS) gangs cashing in on critical infrastructure organisations, and vulnerabilities in IoT CCTV cameras.

Nozomi’s research has found that critical manufacturing vulnerabilities spiked 148% in the first half of 2021, with critical manufacturing the most susceptible industry, while a spotlight on IoT security cameras highlighted how quickly the attack surface is expanding.

“Colonial Pipeline, JBS and the latest Kaseya software supply chain attack are painful lessons that the threat of ransomware attacks is real,” said Nozomi Networks Co-founder and CTO Moreno Carullo.

“Security professionals must be armed with network security and visibility solutions that incorporate real time threat intelligence and make it possible to quickly respond with actionable recommendations and plans. Understanding how these criminal organisations work and anticipating future attacks is critical as they defend against this unfortunate new normal.”

Nozomi Networks’ latest “OT/IoT Security Report” gives cybersecurity professionals an overview of the OT and IoT threats analysed by the Nozomi Networks Labs security research team. The report found:

• Analysis of DarkSide, REvil and Ryuk highlight the growing dominance of RaaS models.

• ICS-CERT vulnerabilities increased 44% in the first half of 2021.

• Vulnerabilities in the critical manufacturing sector rose 148%.

• The top 3 industries affected included critical manufacturing, a grouping identified as multiple industries, and the energy sector.

• Software supply chain-related vulnerabilities continue to surface – as do medical device vulnerabilities.

With more than a billion CCTV cameras expected to be in production globally this year, insecure IoT security cameras are a growing concern. The report includes an analysis of the Verkada breach and security vulnerabilities in Reolink cameras and ThroughTek software – discovered by Nozomi.

“As industrial organisations embrace digital transformation, those with a wait and see mindset are learning the hard way that they weren’t prepared for an attack,” said Nozomi Networks CEO Edgard Capdevielle.

“Threats may be on the rise, but technologies and practices to defeat them are available now. We encourage organisations to adopt a post-breach mindset pre-breach and strengthen their security and operational resiliency before it’s too late.”

“In Australia and New Zealand we’ve seen much greater impact in how OT attacks are affecting the lives of people and businesses in a very real way,” said Manager Solutions Delivery and Projects (APAC) for Nozomi Networks Malcolm Bailie. Colonial Pipeline, JBS and Kaseya all happened well away from our shores – yet those attacks would have been an important topic in board rooms here.”

“The board room has become very aware of the ease of disruption that a similar industry cyberattack can cause their company. As critical organisations that we rely upon for the economy or critical parts of the supply chain are investing heavily in new digital services, it’s important that the convergence of IT, OT and IoT security risks are clearly understood and mitigated.”

Nozomi Networks’ “OT/IoT Security Report” provides security professionals with key insights for re-evaluating risk models and security programs, along with actionable recommendations for securing operational systems. The report focuses on ransomware, new vulnerability disclosures and the security risks of IoT security cameras.