Connect with us

Hi, what are you looking for?

White Papers

Trend Micro report reveals malicious URL attacks prevalent in PH

The report warns that attackers are using more advanced methods to target fewer victims with the potential for higher financial gains.

Photo by Mika Baumeister from Unsplash.com

Trend Micro Incorporated, a global cybersecurity player, revealed a 10% annual increase in total threats blocked in 2023, as detailed in its latest report, Calibrating Expansion: Annual Cybersecurity Threat Report. The report warns that attackers are using more advanced methods to target fewer victims with the potential for higher financial gains.

Ian Felipe, Trend Micro Philippines Country Manager: “We’re blocking more threats than ever before for our customers. However, adversaries showed a variety and sophistication of tactics, techniques, and procedures (TTPs) in their attacks, especially in defense evasion. As our report demonstrates, network defenders must continue to proactively manage risk across the entire attack surface today. Understanding the strategies favored by our adversaries is the foundation of effective defense.”

Trend Micro blocked 161 billion threats overall in 2023, compared to 82 billion threats five years ago. Some of the key global findings include:

  • Email malware detection surged by 349% year-on-year (YoY), while malicious phishing URL detections declined by 27% YoY — suggesting a trend for more using malicious attachments rather than links directly included in emails
  • Business email compromise (BEC) detections increased 16% YoY
  • Ransomware detections dropped 14%, however, there was a 35% increase in threats blocked under Trend Micro’s File Reputation Services (FRS)

These findings suggest that firstly, threat actors are becoming more prudent about selecting their targets, and secondly, becoming more skilled in bypassing early detection layers. In the case of malicious emails, for instance, instead of launching large-scale attacks that rely on victims clicking on malicious links in websites and emails, cybercriminals are targeting a smaller pool of higher-profile victims with more sophisticated attacks. This approach helps them evade network and email filters, which could explain the surge in file detections at endpoints.

Similarly, in the case of ransomware, the increase in FRS detections suggests that threat actors are getting better at evading primary detection via techniques such as Bring Your Own Vulnerable Driver (BYOVD) and zero-day exploits, among others.

Advertisement. Scroll to continue reading.

The report also illuminated threat developments in Southeast Asia in 2023. While Southeast Asia saw an overall increase in ransomware detections, making up more than half (52%) of the global number, this was largely attributed to significant detections within Thailand. Other markets such as Indonesia, Malaysia, Singapore, and the Philippines saw a decline in ransomware detections, similar to the overall global trend. In the Philippines, the number of ransomware detections fell by 93%.

The report also delved into the Philippine threat landscape in 2023, which revealed that the government was largely targeted in Advanced Persistent Threat (APT) campaigns. Specifically, the report exposed that adversary groups Earth Estries (active from January 2023 to present) and Mustang Panda (active from August 2023 to present) have been targeting local government organizations.

Earth Estries is known to deploy cyberespionage campaigns and use multiple backdoors and hacking tools, while Mustang Panda utilizes components of legitimate software for Dynamic Link Library (DLL) sideloading to gather user information.

Looking at other threats studied, malicious URLs being accessed in the Philippines remain prevalent. Despite a 20% decline, detections remained high, totaling over 76 million. A similar trend is seen for other threats, with a high number of detections despite a YoY decline. These include email threats (27%), and botnet victims (27%). Meanwhile, malware detections increased by 12%.

In light of these findings, Trend Micro advises network defenders to:

Advertisement. Scroll to continue reading.
  • Work with trusted security vendors with a cybersecurity platform approach to ensure resources are not only secured but also continuously monitored for new vulnerabilities.
  • Prioritize SOC efficiency by monitoring cloud applications carefully as they become more closely integrated into day-to-day operations.
  • Ensure all the latest patches/upgrades are applied to operating systems and applications.
  • Utilize comprehensive security protocols to safeguard against vulnerabilities, tighten configuration settings, control application access, and enhance account and device security. Look to detect ransomware attacks earlier in the attack lifecycle by shifting left in defenses during initial access, lateral movement, or data exfiltration stages.

To read a copy of the report, Calibrating Expansion: Annual Cybersecurity Threat Report, visit https://www.trendmicro.com/vinfo/ph/security/research-and-analysis/threat-reports/roundup/calibrating-expansion-2023-annual-cybersecurity-threat-report.

Advertisement
Advertisement
Advertisement

Like Us On Facebook

You May Also Like

ELECTRONICS

Philips EasyKey partnered with Megaworld and equipped their world-class properties with only the best-in-class smart locks we have on offer, the Philips EasyKey 9300.

HEADLINES

The PLDT wireless unit is also calling on customers to report these messages to Smart’s HULISCAM portal for further action.

HEADLINES

Here are some tips from Sophos for staying secure online during the cybersecurity awareness month.

HEADLINES

While only 21% of hackers believed that AI technologies enhance the value of hacking in 2023, 71% reported it to have value in 2024....

HEADLINES

Kaspersky has enhanced its Kaspersky Industrial CyberSecurity (KICS), a native XDR Platform for industrial enterprises, and streamlined Managed Detection and Response (MDR) for Industrial...

HEADLINES

Smart has received reports about unscrupulous individuals pretending to be company executives or representatives of organizations asking for donations for made-up or nonexistent relief...

HEADLINES

Located in the Kaspersky office, the new facility will provide the company’s stakeholders with services ranging from an overview of Kaspersky’s practices, to a...

HEADLINES

Smart and Maya emphasize that they never send SMS with links requesting login credentials, personal information, or account verification. If you receive such a...

Advertisement