In 2024 year Belarus was the second place in the world by the share of users attacked by cyberthreats from the Internet, that is 43.5% of our country’s internet users. The first place is Russia. This and other data was presented by Kaspersky at the press-conference “Results of the Year in cybersecurity”, which was held on 11 December in Minsk.
In the framework of the event experts company told about the actual landscape of cyberthreats for Belarusian organizations and users, and also the latest threats from the side of artificial intelligence – dipfakes.
Daily Kaspersky detects 467 thousand unique malicious objects. A year earlier 411 thousand were detected. From the beginning of the current year more than 20 20 million attacks on computers in the RB. The volume of blocked phishing increased in 1.7 times.
Key threats to business. The largest increase in blocked attempts to attack organizations was recorded among local cyberthreats, spyware and backdoors. So, the number of attacks by local malicious files distributed, for example, through removable media, in encrypted documents or in complex installers, increased by 12%. The number of
attacks using spyware increased by 34%, and backdoors, that is, malware for hidden remote control of the device, by 36%.
“If talking about attacksThrough the Internet, one of the major threats to users, and to organizations, in 2024, in the year phishing also remains . His final purpose is to extract those or other data. In the last 11 months our security technologies have blocked millions of attempts by Belarusian users to go to phishing pages. So the indicator increased in 1.7 fold in compared with the last year, that says about increased activity of criminals in this area”, Dmitry Kudrevich, a representative of Kaspersky in Belarus.
Actual cyber threat to Belarusian organizations remains and encryptors. Kaspersky’s Kaspersky Solutions reflected more than 20 20 thousand such attacks – without counting the attacked segments of medium and small businesses in Belarus.
The Top 5 prevalent malicious software in attacks on Belarusian organizations in 2024 year are Netwire RAT, Agent Tesla, NjRAT: This is a malicious PO with different functionality. Depending on the Malware involved in the attack, in if successful the attackers can steal information from the infected corporate device, make screenshots, execute intelligence, launch DDDoS attacks, install additional malicious software.
Another common cyber threat is the Redline styler , with the help of thieves attempting to steal logins, passwords, cookies, data of bank cards and crypto wallets, download and run third-party programs on the victims’devices.
Also the legal Impacket tool Impacket: attackers use it topost-exploitation, lateral movement across the network, extraction of accountable data from processes, execution of NTLM relay attacks.
To ensure the security of the corporate perimeter, Kaspersky Kaspersky recommends that organizations:
- use EDR solutions to identify and respond to incidents at the endpoint level;
- Regularly update PO on all corporate devices to avoid unauthorized intrusion into the internal network through vulnerabilities;
- use SIEM system designed for centralized collection, analyze and correlate incidents of IS from different sources of data to identify potential cyberthreats and neutralize them in a timely manner;
- do not open remote desktop services (e.g., RDP) for public networks, unless it is absolutely necessary, and always use secure passwords for them;
- use up-to-date Threat intelligence data to remain informed about the current techniques, tactics and procedures of attackers. For example, Kaspersky Threat Intelligence Kaspersky Kaspersky Threat Intelligence portal can receive data about cyberattacks collected by the company over more than 20 years;
- increase digital literacy of all staffthroughtraining,andalsoconductspecializedtrainingforinformationsecurityemployees;
- regularly createbackupcopiesofcorporatedataandstoreitso thatitcanbequicklyaccessedintheneed:backupcopiesshouldbeisolatedfromthenetwork.