Top 3 Menace Report Observations for the Second Quarter of 2024
Cato CTRL (Cyber Threats Research Lab) has published its Q2 2024 Cato CTRL SASE Threat Report. The report showcases crucial discoveries derived from the analysis of an impressive 1.38 trillion network flows from over 2,500 of Cato’s worldwide clients, during the period of April to June 2024.
Primary Revelations from the Q2 2024 Cato CTRL SASE Threat Report
The report is filled with exclusive observations resulting from thorough data scrutiny of network flows. Below are the top three insights for corporations.
1) IntelBroker: A Steadfast Threat Actor in the Cyber Underground
Following a comprehensive exploration of hacking communities and the dark web, Cato CTRL identified a well-known threat actor named IntelBroker. IntelBroker is a significant personality and moderator within the BreachForums hacking community and has been actively engaged in the marketing of data and source code from major corporations. These encompass AMD, Apple, Facebook, KrypC, Microsoft, Space-Eyes, T-Mobile and the US Army Aviation and Missile Command.
2) 66% of Brand Imitation Centres on Amazon
Cybersquatting involves the imitation and exploitation of a brand’s domain name to capitalize on its registered trademark. As per the report, Amazon stood out as the most frequently mimicked brand, with 66% of such domains focusing on the retail giant. Google followed, albeit with a significant margin, at 7%.
3) Log4j Continuously Under Exploitation
Despite its unearthing in 2021, the Log4j vulnerability continues to be a favored instrument among threat actors. From Q1 to Q2 2024, Cato CTRL documented a 61% surge in attempted Log4j breaches in inbound traffic and a 79% climb in WANbound traffic. Similarly, the Oracle WebLogic vulnerability, initially detected in 2020, witnessed a 114% hike in exploitation attempts within WANbound traffic over the same timeframe.
Security Proposals
Based on the insights from the report, Cato CTRL suggests that organizations adhere to the following finest practices:
- Consistently scan dark web forums and marketplaces for any mention of your company’s data or credentials being sold.
- Utilize tools and methodologies to identify and counteract phishing and other assaults leveraging cybersquatting.
- Establish a preemptive patching routine focused on critical vulnerabilities, particularly those actively pursued by threat actors, such as Log4j.
- Formulate a systematic strategy for reacting to a data breach.
- Embrace an “assume breach” mindset with approaches like ZTNA, XDR, pen testing and more.
- Develop an AI oversight plan.
Find additional suggestions with detailed information in the report.
About Author
