Report Spotlights Malicious GenAI, New Malware Languages, and Geopolitical Threat Surge
Trellix issued The CyberThreat Report from its Advanced Research Center, noting collaboration between ransomware groups and nation-state-backed APT actors, the use of less common programming languages for malware, and the development of Generative AI tools by cybercriminals.
“As technology advances, so does cybercrime – and understanding the changing landscape is vital for CISOs and SecOps teams to stay ahead of threats,” said John Fokker, Head of Threat Intelligence, Trellix Advanced Research Center.”
“As technology advances, so does cybercrime – and understanding the changing landscape is vital for CISOs and SecOps teams to stay ahead of threats”
John Fokker, Head of Threat Intelligence, Trellix Advanced Research Center
The Trellix Advanced Research Center’s latest CyberThreat Report includes:
- Malicious GenAI: Cybercriminals bypass protections to take advantage of commonly known tools and use GenAI to enhance phishing campaigns. The accelerating scale and speed of phishing attacks indicates malicious GenAI may already be in deployment today.
- Geopolitical Threat Activity: Nation-state threat activity spiked over 50% in the last six months due to conflict escalation in Russia and Ukraine, intensified cyber activity in Israel just before and during the conflict, and disruptive attacks on Taiwan heading into their 2024 elections.
- Ransomware Developments: Global detections and industry-reported incidents, particularly in Q2, reflect unusual variations in ransomware families, as well as countries and industries targeted. The Trellix Advanced Research Center also observed a splintering of large ransomware groups, with the introduction of smaller groups and more attacks focused on data exfiltration.
- Underground Collaboration: The last six months demonstrated an increase in threat actors actively collaborating on Dark Web forums. This spanned groups formally joining together (“The Five Families”), an escalation in selling/sharing of zero-day vulnerabilities, joint PoC development efforts to accelerate exploitations, and more.
- Polyglot Malware: Cyber, a polycrisis itself, is a threat multiplier – and the rise of polyglot malware further exacerbates this. New programming languages are becoming popular malware choices, with Golang seeing high usage for ransomware (32%), backdoors (26%), and Trojan Horses (20%).
The cybersecurity landscape experiences upheaval regularly as geopolitical and economic developments create an increasingly complicated and uncertain world. New cyber actors emerge daily while new vulnerabilities, exploits, and tactics are constantly discovered. The comprehensive analysis provided by the Trellix Advanced Research Center serves as a vital resource for today’s CISOs to understand and mitigate evolving cybersecurity risks in an interconnected world.
