Security teams today are facing endless waves of cyberattacks. They continue to reel from pandemic disruptions and burnout while bracing for a barrage of cyberattacks. Many of those attacks are geopolitically motivated – specifically, tied to Russia’s invasion of Ukraine. In fact, according to VMware’s eighth annual Global Incident Response Threat Report, 65% of defenders state that cyberattacks have increased since Russia invaded Ukraine of February 24.

Many of the cyber attacks are directly related to Russia’s Ukraine campaign.  Leading up to the invasion, Russian cyberattacks hit Ukraine’s largest gas retailer, their defense ministry’s website and at least 21 companies involved in the liquefied natural gas industry. This included Chevron, Cheniere Energy and Kinder Morgan. New malware and exploits targeting Ukrainian government networks, domestic telecom companies and other critical infrastructure continued after the invasion.

Zero-day exploits also are showing no signs of abatement after record levels last year. A little less than two-thirds of respondents said they experienced such attacks in the past 12 months, up from 51% in 2021. This surge is also attributed to largely to geopolitical conflict.

The report shined a light on emerging threats such as deepfakes. Deepfake attacks rose by 13% with 66% of respondents saying they witnessed them in the past 12 months. Email was the top delivery method at more than three-fourths, for such attacks, which corresponds with the rise in BECs. From 2016 to 2021, BEC incidents cost organizations an estimated $43.3 billion, according to the FBI.

“Cybercriminals have evolved beyond using synthetic video and audio,” said Rick McElroy, principal cybersecurity strategist at VMware. “Their new goal is to use deepfake technology to compromise organizations and gain access to their environment.”

APIs are also increasingly under threat – 23% of all attacks seen by respondents in the past 12 months compromised API security. Breached systems can be used to distribute attacks, known as progressive API attacks.

With rising threats, incident responders are fighting back and 87% saying that they are able to disrupt a cybercriminal’s activities sometimes or very often. However, they need to be able to perform even better if they hope to continue to repel threats. Security teams need more visibility across today’s widening attack surfaces to be better equipped to weather the storm.

To do this, security teams should:

• Focus on workloads holistically. Companies must understand the inner workings of their entire workload.
• Inspect in-band traffic. Many modern attacks succeed by disguising themselves as legitimate IT practices.
• Integrate network detection and response with endpoint detection and response.
• Embrace Zero Trust principles. This broad approach to security assumes every digital transaction could be dangerous.
• Conduct continuous threat hunting. Security teams should assume attackers have multiple avenues into their organization.

Just as security teams were feeling a calm from pandemic disruptions, an endless wave of threats came in full force, and have not slowed down. As long as security teams have more visibility of the widening attack surface, they will be better equipped to defeat the bad actors and prevent successful attacks.

Edited by Erik Linask