The same is true for the initial access vector. “The intent is different, but the ransomware itself isn’t. For instance, Chinese threat actors were detected deploying ransomware as a smokescreen for espionage,” said McLellan. “Government-sponsored threat actors have a different purpose to those who are financially motivated, but the tools and techniques they use are often the same. The vast majority (90%) were linked to China.

The firm also recorded a slight uptick in state-backed activity, increasing from 6% to 9% of all attacks. This analysis chimes with a recent Trend Micro report, which suggested that ransomware groups will increasingly look to adopt other criminal models that monetize initial access, like BEC.Įlsewhere, Secureworks claimed that vulnerabilities in internet-facing systems accounted for another third of initial access vectors, warning that it is known bugs like Log4Shell, rather than zero days, that represent the biggest threat. “Attackers can simultaneously phish multiple organizations looking for potential victims, without needing to employ advanced skills or operate complicated affiliate models,” he added.

Mike McLellan, director of intelligence at Secureworks, argued that BEC attacks can generate a big payout but require relatively little technical skill. At the same time, it could also represent a shift in threat actor monetization strategies. Secureworks suggested that the fall could be down to threat actors targeting smaller victims, which are less likely to engage with incident responders like the report’s sponsor. Read more about the top-grossing cybercrime categories: Investment Fraud is Now Biggest Cybercrime Earner. It claimed the significant growth in BEC volumes was down to a surge in phishing, which accounted for a third (33%) of initial access vectors – up from 13% in 2021.Īt the same time, ransomware fell from its perch as the most common cybercrime type, with detections declining 57%. The threat detection and response firm compiled its Learning from Incident Response report from hundreds of real-world incidents it was called upon to investigate. The number of business email compromise (BEC) incidents doubled last year and replaced ransomware as the most prolific cybercrime category, according to Secureworks.

Last pass authenticator