Education, research most targeted sectors by cyber criminals in 2021: Report

Cyber attacks against organisations worldwide increased by an average of 50 per cent in 2021 as compared to 2020, a report by Check Point Software has said.

The report titled 'Cyber Attack Trends: 2022 Security Report', which covers key cybersecurity trends from 2021, said that 2021 saw numerous sophisticated attacks such as Codecov in April and Kaseya in July, concluding with the Log4j vulnerability that was exposed in December. The striking impact achieved by this one vulnerability in an open-source library demonstrates the immense inherent risk in software supply chains.

"In a year that began with the fallout from one of the most devastating supply chain attacks in history, we've seen threat actors grow in confidence and sophistication," said Maya Horowitz, VP Research at Check Point Software. "This culminated in the Log4j vulnerability exploit which, yet again, caught the security community off-guard and brought to the fore the sheer level of risk inherent in software supply chains. In the months between, we saw cloud services under attack, threat actors increasing their focus on mobile devices, the Colonial Pipeline held to ransom, and the resurgence of one of the most dangerous botnets in history."

Education and research were the most targeted sectors, with organisations facing an average of 1,605 weekly attacks, an increase of 75 per cent. This was followed by government/ military with 1,136 weekly attacks, registering a 47 per cent increase. Communications registered 51 per cent increase with 1,079 weekly attacks and software vendors experienced the largest year-on-year growth (146 per cent), which goes hand-in-hand with the ever-increasing trend of software supply chain attacks observed in 2021.

With a large number of attacks targeted critical infrastructure, cyber attacks disrupted everyday life, and, in some cases, even threatened the sense of physical security.

Throughout the year, threat actors increasingly used smishing (SMS phishing) for malware distribution and invested substantial efforts in hacking social media accounts to obtain access to mobile devices. The continued digitisation of the banking sector in 2021 led to the introduction of various apps designed to limit face-to-face interactions, and those in turn have led to the distribution of new threats.

Lastly, as ransomware attacks increased, governments and law enforcement agencies changed their stance on organised ransomware groups in 2021, turning from pre-emptive and reactive measures to proactive offensive operations against ransomware operators, their funds and supporting infrastructure. The major shift happened following the Colonial Pipeline incident in May which made the Joe Biden administration realise that it has to step up efforts to combat the threat.

Also read: Cyber-crime getting more sophisticated: Rob Lefferts, security expert

Also read: Digitization advances led to increasingly damaging cyber incidents: WEF Report