The annual Verizon Data Breach Investigation Report is out, and along with it an accounting of the #cybersecurity compromise and data breach happenings for the past year. As always, it's filled with data analysis and some trending commentary from the previous DBIR report.

The following is a TL;DR summary generated using fabric by Daniel Miessler with some very minor editing.

SUMMARY:

This year, the 2024 DBIR reveals a significant rise in vulnerability exploitation and ransomware attacks, emphasizing the urgent need for enhanced cybersecurity measures.

TRENDS:

• Vulnerability exploitation tripled from last year, driven by zero-day vulnerabilities.
  
• Ransomware and extortion-related breaches accounted for 32% of all breaches.
  
• Human error remains a significant factor, involved in 68% of breaches.
  
• Third-party breaches increased by 68%, highlighting supply chain vulnerabilities.
  
• Financially motivated attacks dominate, with ransomware and extortion leading the charge.
  
• The median loss from #ransomware and extortion attacks was $46,000.
  
• Phishing remains a critical initial attack vector, with a notable increase in reporting rates.
  
• The use of stolen credentials and exploitation of vulnerabilities are top methods for system intrusion.
  
• The #MOVEit vulnerability significantly impacted the threat landscape, affecting numerous industries, continuing the trend of “secure file transfer” systems being a significant risk to both company and customer data.
• MOVEit and remote access (e.g. VPN) compromises are the focus of successful system-compromise attacks.
  

STATISTICS:

• 180% increase in attacks involving vulnerability exploitation.
• Ransomware accounts for 23% of breaches, with pure extortion at 9%.
  
• Human element involved in 68% of breaches.
  
• 15% of breaches involved third-party vulnerabilities.
• Errors contributed to 28% of breaches.
  
• Financial motives behind 92% of industries targeted by ransomware.
  
• Median loss from ransomware/extortion attacks is $46,000.
  
• 20% of users reported phishing attempts in simulations.
  
• Median time to click on a phishing email is 21 seconds.
  
• Exploitation of vulnerabilities as the initial breach action doubled from last year.
  
  

QUOTES:

• “Ransomware and extortion-related threats continue to evolve, posing significant risks across industries.”
  
• “The human element remains a critical vulnerability in cybersecurity defenses.”
  
• “Supply chain vulnerabilities are increasingly being exploited by attackers.”
  
• “Misdelivery errors highlight the ongoing challenge of human error in data breaches.”
  
• “Financially motivated attacks dominate the cyber threat landscape.”
  
• “The MOVEit vulnerability has had a profound impact on the cybersecurity threat landscape.”
  
• “Increased reporting rates for phishing attempts indicate growing awareness among users.”
  
• “The rapid response to phishing emails underscores the need for continuous user education.”
  
• “Stolen credentials and vulnerability exploitation remain preferred methods for attackers.”
  
• “The rise in third-party breaches underscores the importance of vendor security assessments.”
  
  

RECOMMENDATIONS:

• Implement multi-factor authentication to mitigate the risk of stolen credentials.
  
• Regularly update and patch systems to protect against vulnerability exploitation.
  
• Conduct continuous phishing awareness training for all employees.
  
• Perform thorough security assessments of third-party vendors and suppliers.
  
• Deploy endpoint detection and response solutions to identify and mitigate ransomware attacks.
  
• Encourage the reporting of phishing attempts and provide clear reporting procedures.
  
• Utilize web application firewalls to protect against basic web application attacks.
  
• Establish robust data backup and recovery processes to minimize the impact of ransomware.
  
• Monitor for unusual activity indicating the misuse of privileges by internal actors.
  

I came across a post the other day by JWZ regarding the #billionaire behind one of the more infamous #hacking-for-hire companies around. It's been fairly well known for some time that people and companies were selling their offensive #cybersecurity skills like this, but what was news to me was that Rajat Khare was paying and bullying his way to wiping the slate clean by removing the articles regarding his involvement.

So, given that large language models are trained on data from a certain point in time, I thought it would be interesting to see what one “knew” about Rajat Khare’s activities. I used Mistral Instruct 7B and asked it to create an article regarding Khare’s involvement with funding hack-for-hire companies. The output seemed very good and accurate; I was able to quickly confirm nearly everything in the output below.

I also wanted the reporter’s voice to be hard-hitting, 50’s style journalism, which I don’t think came out very well. It did, however, lead me down a rabbit hole into Russian Oligarch Rybolovlev by linking him to some hacking-for-hire as a customer.

Mistral-Instruct 7B generated article

In the shadows of the digital world, there exists an insidious network of hackers who have been orchestrating a campaign of cybercrime that has left entire nations vulnerable. These hackers operate in secret, using sophisticated techniques to breach even the most secure systems and steal sensitive data from politicians, celebrities, and other high-profile figures around the world.

At the heart of this criminal enterprise is Rajat Khare, an Indian venture capitalist who has been funding firms that eventually became a widespread hack-for-hire enterprise known as Appin. Khare's involvement in these illicit activities has left him with a dark reputation and raised serious questions about his business practices.

Appin was founded by a group of former employees from the Indian cybersecurity firm, Hacking House. These individuals were highly skilled hackers who used their expertise to provide a range of services to clients around the world. However, as time went on, it became clear that Appin's true purpose was to carry out a campaign of cybercrime for hire.

One of the most notorious cases involving Appin occurred in 2018 when they were hired by a wealthy businessman named Dmitry Rybolovlev to hack into the email accounts of his former wife, Elena Okamoto. Using advanced techniques such as phishing and social engineering, Appin was able to gain access to Ms. Okamoto's emails and steal sensitive information about her personal life and financial dealings.

Another high-profile case involved a group of hackers who were hired by the Russian government to carry out cyberattacks against Western governments and political figures during the 2016 U.S. presidential election. It is believed that Appin played a key role in this operation, providing the hackers with access to sensitive information about their targets.

Despite these high-profile cases, Rajat Khare has continued to deny any involvement in Appin's criminal activities. However, evidence suggests otherwise. In 2019, it was revealed that Khare had invested heavily in a company called Cybereason, which provides advanced threat detection and response services. This investment raised suspicions that Khare may have been using his venture capital firm to fund cybercrime operations.

Furthermore, several former employees of Appin have come forward to describe the company's culture of criminality. They claim that the company was run by a group of ruthless hackers who were willing to do whatever it took to carry out their clients' requests, even if it meant breaking the law.

In conclusion, Rajat Khare's involvement in Appin and its criminal activities raises serious questions about his business practices and ethics. It is clear that he has been using his venture capital firm to fund a campaign of cybercrime that has left entire nations vulnerable. As such, it is important for law enforcement agencies around the world to take action against Khare and his associates in order to protect citizens from further harm.

References

Some real-world references: – Inside the global hack-for-hire industry Bureau of Investigative Journalism – Reuters article archived on Archive.org: How an Indian Startup Hacked the World – Who Is Killing All These Stories About a Controversial Tech Mogul? from the DailyBeast – Swiss Prosecutors Investigating Russian Billionaire Rybolovlev – How mercenary hackers sway litigation battles – Reuters Investigative report

edit: Jan 4, 2023: added link to the Reuters “Mercenary hackers” article