Leading 3 Risks Overview for the Second Quarter of 2024
Cato CTRL (Cyber Threats Research Lab) has unveiled its Q2 2024 Cato CTRL SASE Threat Report. The report showcases significant discoveries derived from the scrutiny of a whopping 1.38 trillion network flows from over 2,500 of Cato’s worldwide clients, during the period from April to June 2024.
Key Notions from the Q2 2024 Cato CTRL SASE Threat Report
The report includes distinctive insights based on a comprehensive study of network flows. Here are the top three insights essential for corporations.
1) IntelBroker: A Prolific Threat Actor in the Cyber Underworld
Following an extensive exploration of hacking circles and the deep web, Cato CTRL pinpointed a notorious threat actor going by the alias IntelBroker. IntelBroker is a well-known personality and administrator within the BreachForums hacking community, actively engaged in vending data and source code from major firms. These encompass AMD, Apple, Facebook, KrypC, Microsoft, Space-Eyes, T-Mobile, and the US Army Aviation and Missile Command.
2) 66% of Brand Counterfeiting Focused on Amazon
Cybersquatting entails counterfeiting and exploiting a brand’s domain name to benefit from its recognized trademark. The report highlights that Amazon was the most commonly counterfeited brand, with 66% of such domains targeting the e-commerce giant. Google registered a distant second position, with just 7%.
3) Log4j Continues to Be Exploited
Despite its exposure in 2021, the Log4j vulnerability remains a favored instrument among threat actors. From the first quarter to the second quarter of 2024, Cato CTRL documented a 61% surge in attempted Log4j exploits in incoming traffic and a 79% escalation in WANbound traffic. Likewise, the Oracle WebLogic vulnerability, initially identified in 2020, saw a 114% uptick in exploitation attempts within WANbound traffic over the same timeframe.
Security Suggestions
In line with the insights from the report, Cato CTRL suggests that organizations embrace the following optimal methodologies:
- Consistently monitor dark web forums and marketplaces for any references to your company’s data or credentials being traded.
- Implement tools and methodologies to detect and neutralize phishing and other cyber attacks utilizing cybersquatting.
- Institute a proactive patching regime concentrating on critical vulnerabilities, especially those actively targeted by threat actors, such as Log4j.
- Draft a systematic strategy for addressing a data breach.
- Adopt an “assume breach” attitude employing approaches like ZTNA, XDR, penetration testing, and more.
- Formulate an AI governance blueprint.
Delve into additional recommendations and more detailed insights within the report.
About Author
