Trellix detects collaboration by cybercriminals and nation states

Issue 7 2023 News & Events, Information Security


Carlo Bolzonello.

Trellix has released The CyberThreat Report: November 2023 from its Advanced Research Centre. Trellix observed indicators of collaboration between ransomware groups and nation-state-backed advanced persistent threat (APT) actors, adoption and usage of lesser-known programming languages for malware, and cybercriminals developing Generative AI (GenAI) tools.

"As technology advances, so does cybercrime, and understanding the changing landscape is vital for CISOs and SecOps teams to stay ahead of threats," said John Fokker, Head of Threat Intelligence, Trellix Advanced Research Center. “Cybercriminals are becoming increasingly more agile, organised, and politically aligned. It is imperative that defenders refer to threat intelligence to strengthen their security posture with limited resources."

The Trellix Advanced Research Center’s latest CyberThreat Report includes:

● Malicious GenAI: Cybercriminals bypass protections to take advantage of commonly known tools and use GenAI to enhance phishing campaigns. The accelerating scale and speed of phishing attacks indicates malicious GenAI may already be in deployment today.

● Geopolitical Threat Activity: Nation state threat activity spiked over 50% in the last six months due to conflict escalation in Russia and Ukraine, intensified cyber activity in Israel just before and during the conflict, and disruptive attacks on Taiwan heading into their 2024 elections.

● Ransomware Developments: Global detections and industry-reported incidents, particularly in Q2, reflect unusual variations in ransomware families, as well as countries and industries targeted. The Trellix Advanced Research Center also observed a splintering of large ransomware groups, with the introduction of smaller groups and more attacks focused on data exfiltration.

● Underground Collaboration: The last six months demonstrated an increase in threat actors actively collaborating on Dark Web forums. This spanned groups formally joining together (‘The Five Families’), an escalation in selling/sharing of zero-day vulnerabilities, joint PoC development efforts to accelerate exploitations, and more.

● Polyglot Malware: Cyber, a polycrisis itself, is a threat multiplier – and the rise of polyglot malware further exacerbates this. New programming languages are becoming popular malware choices, with Golang seeing high usage for ransomware (32%), backdoors (26%), and Trojan Horses (20%).

The cybersecurity landscape experiences upheaval regularly as geopolitical and economic developments create an increasingly complicated and uncertain world. New cyber actors emerge daily, while new vulnerabilities, exploits, and tactics are constantly discovered. The comprehensive analysis provided by the Trellix Advanced Research Center serves as a vital resource for today’s CISOs to understand and mitigate evolving cybersecurity risks in an interconnected world.

The CyberThreat Report: November 2023 includes proprietary data from Trellix’s sensor network, investigations into nation state and cybercriminal activity by the Trellix Advanced Research Center, and open and closed-source intelligence. The report is based on telemetry related to detection of threats, when a file, URL, IP-address, suspicious email, network behaviour, or other indicator is detected and reported by the Trellix XDR platform.




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Highest increase in global cyberattacks in two years
Information Security News & Events
Check Point Global Research released new data on Q2 2024 cyber-attack trends, noting a 30% global increase in Q2 2024, with Africa experiencing the highest average weekly per organisation.

Read more...
From the editor's desk: Interesting times
Technews Publishing News & Events
We certainly live in interesting times. From delaying the budget speech because the ANC doesn’t see any reason why VAT shouldn’t be increased by 2%, to crime fighters being set up and prosecuted in ...

Read more...
World-first safe K9 training for drug detection
Technews Publishing SMART Security Solutions Editor's Choice News & Events Security Services & Risk Management Government and Parastatal (Industry)
The Braveheart Bio-Dog Academy recently announced the results of its scientific research into training dogs to accurately detect drugs and explosives without harming either the dogs or their handlers.

Read more...
Bosch sells product business to Triton
Bosch Building Technologies News & Events Products & Solutions Facilities & Building Management
Bosch is selling its Building Technologies division’s product business for security and communications technology to the European investment firm Triton. The division is set to focus on systems integration business in the future.

Read more...
Nice launches DC Blue Astute garage door motor
Nice Group South Africa Technews Publishing News & Events Access Control & Identity Management Perimeter Security, Alarms & Intruder Detection
Nice Systems SA has launched the Nice DC Blue Astute, a garage door motor for the South African market featuring a pre-installed lithium-ion battery instead of traditional lead-acid batteries.

Read more...
The human element remains the cornerstone of success
News & Events
Gallagher Security, has unveiled its Security Industry Trends Report 2025, offering insights into the rapid evolution of security systems and the broader role they play in business operations worldwide.

Read more...
New firearms training modules from ITA
News & Events Security Services & Risk Management
The International Firearm Training Academy has launched two new firearms training modules to support career development in the firearms industry: the Maintenance Fitter and the Firearms Custodian modules.

Read more...
The IoT trends shaping a smarter, more connected future
IoT & Automation News & Events
The Internet of Things (IoT) is revolutionising sectors across Africa. In 2025, IoT is expected to continue driving digital innovation, enhancing operational efficiencies, and enabling the creation of smarter, more sustainable ecosystems.

Read more...
New AI advisor for robot selection
News & Events Industrial (Industry) AI & Data Analytics
Igus’ new AI chatbot has been added to its online platform to enable companies with little previous experience and technological expertise to quickly and reliably put together Low-Cost Automation (LCA) solutions to become more competitive.

Read more...
Identity is a cyber issue
Access Control & Identity Management Information Security
Identity and access management telemetry has emerged as the most common source of early threat detection, responsible for seven of the top 10 indicators of compromise leading to security investigations.

Read more...