Turning Tides

Navigang the Evolving World of Cybercrime

H1 2023

CRIMEWARE TRENDS

AND HIGHLIGHTS

AUGUST | 2023

In the rst half of 2023, Arete observed several

disnct trends and shis in the cyber threat landscape.

Leveraging the data collected during each incident

cybersecurity. In response to several high-prole aacks

in the past three years, many organizaons invested

in security tools, training, and services to reduce risk.

To evade these standard security tools and common

defense strategies, threat actors shied their operaons

to target dierent types of operang systems with

increasingly complex taccs.

The threat landscape connues to evolve with the

widespread introducon of AI tools, lower barriers

of entry into cybercrime, new vulnerabilies, and the

However, as threat actors evolve, so do the threat

hunters and organizaons tracking them. Global

law enforcement agencies have carried out several

impacul arrests and seizures on mulple high-prole

cybercriminal groups in the rst half of 2023. We have

seen a signicant increase in collaboraon between

law enforcement agencies and civilian cybersecurity

organizaons, resulng in unprecedented informaon

sharing on indicators and taccs, allowing for more

accurate aribuon, restoraon, and potenal

• Mainstay actors prevail and new players arrive on the scene

• Professional services is the most targeted industry

• The percentage of incidents where a ransom is paid fell to 19%

• Cybercrime-as-a-Service on the rise

• Leaked source code skyrockets accessibility

• Arcial Intelligence changes the game

• Threat actors move to exltraon-only operaons

• Targeng of Linux and macOS systems increases aack surface

In the rst half of 2023 (H1 2023), we saw LockBit rise to the top spot, accounng for 30.3% of Arete’s observed

ransomware cases. New variants appeared on the scene, including Akira and Luna Moth. Despite the emergence

of new variants over the past two years, Arete data indicates that dominant and well-established actors sll

maintain their top posions.

H1 2023 Highlights From Arete’s

Incident Response Cases

three over the past four quarters, showcasing their

connued dominance. Lockbit has made connuous

development eorts throughout its tenure, including

improvement to its ransomware builder, releasing

new builders to their aliates, and working to target

other operang systems. Lockbit can now target

Linux systems, and a developmental Lockbit macOS

encryptor was spoed in the wild. Arete has observed

updated versions of LockBit, including LockBit Green

and LockBit Black.

and benets to aliates, could contribute to its

ongoing status as one of the top three most prevalent

threat actor groups.

Another variant observed over the past three quarters

is Royal ransomware, which, like BlackCat, requires

command line arguments to run correctly in a vicm

system. Royal has been acve since September 2021

and was rst observed in an Arete engagement during

Q4 2022. In Q1 2023, we observed a spike in cases,

but the frequency subsequently dropped in Q2.

updated version of their ransomware, eliminang the

aw that allowed the creaon of the free decryptor.

However, like some other ransomware operaons,

they may decide to move to an extoron-only model

at some point.

See page 10 for taccs, techniques, and procedures (TTPs),

and detailed insights on the top ve variants observed.

H1 2023 Highlights From Arete’s

Incident Response Cases

H1 2023 Highlights From Arete’s

Incident Response Cases

Median Ransom Demand

Inial Access Vectors

The rst half of 2023 saw a shi in dominant inial

access vectors. Notably, third-party access tools

accounted for 34.5% of inial access in the second half

of 2022 and just 9.3% in H1 2023. Remote Desktop

Protocol (RDP) held the top spot in H1 2023, observed

in 24.5% of cases, up from just 8.1% in H2 2022.

For detailed informaon about these inial access

vectors, see the appendix.

Figure 4: Inial Access Vectors Observed in H2 2022 and H1 2023

Stolen User Credenals

Malicious Email

Remote Desk Protocol

The following list represents the post-exploit toolsets

our analysts observed in incident response and

managed detecon and response engagements in H1

2023. Documentaon and analysis of malware help us

understand cyberaacks' nature, scope, and impact

during an invesgaon. This insight can give network

see the appendix.

Inial Access Vectors

ChatGPT, the revoluonary product from OpenAI,

encompasses a large dataset of human conversaons

and can generate and address human-like responses.

Since its launch in January 2023, it has garnered

massive global aenon and grown signicantly. A

free version is available for all users, but OpenAI also

language model, developed in 2021 by EleutherAI,

an open-source AI research group. Depending on the

user's input and preferences, the tool generates texts

in dierent languages, formats, and styles and creates

code snippets for various programming languages,

including Python, Java, C#, PHP, and HTML.

WormGPT is described on dark web forums as a

"sophiscated AI model" and a "best GPT alternave

for blackhat" designed especially for cybercrime.

WormGPT has no ethical boundaries or safety

that can trick users into revealing sensive informaon,

downloading malicious soware, or falling for scams.

This new and emerging threat requires more research

and analysis to understand its full capabilies and

potenal impacts.

Cyber criminals can leverage AI tools to create phishing

scams, social engineering aacks, and spamming. In the

near term, it is likely that new versions of AI soware

funconality for threat actors. This, coupled with

threat actors connuing to expand their knowledge

Historically, threat actors have leaned heavily on their

reputaons to inmidate their vicms. And while

actors like LockBit and ALPHV/BlackCat connue

to be mainstays, the ease of rebranding has caused

new and lesser-known actors to place less emphasis

on their reputaon. Groups can easily create new

ransom notes and encrypted le extensions using

ransomware builders, build new communicaon

the latest examples of ransomware groups becoming

more sophiscated and aggressive in their taccs,

targeng crical infrastructure and sensive data.

There was no data encrypon during these aacks.

discovered, indicang that the threat landscape may

be changing for Apple users.

The ransomware showcasing the ability to target

macOS environments was later aributed to the

notorious LockBit ransomware group. In April 2023,

security researchers found samples of LockBit

encryptors for macOS on VirusTotal, a malware

analysis repository. The samples were uploaded in

November and December 2022 but went unnoced

unl MalwareHunterTeam spoed them.

restricons (TCC/SIP), and had bugs that caused

them to crash. The encryptors also did not have any

network communicaon or ransom note funconality.

The researchers concluded that the LockBit

encryptors for macOS were more of an experiment

than a viable threat. Sll, LockBit could improve

and iterate on these tools in the future. The fact

that LockBit was developing a macOS version of its

ransomware could signal a trend toward more Mac-

targeted ransomware, especially as more businesses

scripts to compromise and encrypt devices.

These incidents suggest that macOS users should not

be complacent about the risk of ransomware aacks.

While macOS has some built-in security features

that make it harder for ransomware to run, such as

Gatekeeper, FileVault, and XProtect, these features

are not foolproof and can be bypassed by determined

aackers. Moreover, macOS users may be more

vulnerable to phishing emails and social engineering

taccs, as they may have a false sense of security and

ransomware aackers.

code remotely. ESXiArgs was inially idened as

encrypng les with the .vmxf, .vmx, .vmdk, .vmsd,

and .nvram extensions on compromised ESXi servers

and creang a .args le, but recently the group started

encrypng more extensive amounts of data.

Arete observed the latest version of Royal

Ransomware specically targeng VMware ESXi

virtual machines. Addionally, LockBit released a

new iteraon of their ransomware builder, allowing

threat actors to target Linux environments acvely.

Ironically, along with increasing risks of mobilizaon,

Russian hackers are now facing uncertainty about the

country's "safe haven" status that they enjoyed so far.

War-related expenses and the economic impact of

imposed sancons prompted the Russian government

to propose a new law that enables the conscaon of

proceeds from cybercriminal operaons.

arrests have been announced publicly, including

suspected JabberZeus top manager Vyacheslav "tank"

Penchukov and a suspected "Evil Corp" second-in-

command Igor Turashev.

As a result of increased law enforcement acon, we

have seen an inux of cybercriminal groups deciding

to break up into smaller independent teams or

re-brand in the rst half of 2023. Every month, some

groups disappear (or announce "rerement), and

"new" groups enter the market, which has increased

operate independently while making the enterprise

more resilient to idencaon and inltraon.

The cellular structure can make it harder for these

groups to coordinate large-scale acons, and there's

a greater risk of cells being inltrated or turning

against each other. Nevertheless, it has proven to be

eecve for many cybercriminal organizaons. In the

long run, this structural change may also slow down

the speed of innovaon since smaller cells will be less

likely to have sucient resources to make signicant

on Cybercrime

The increase in high-prole ransomware events

led Congress to form CISA's Joint Ransomware