CTI Trends – September 2024

As we approach the final quarter of 2024, the cyber threat intelligence (CTI) landscape continues to evolve, driven by a combination of emerging threats, geopolitical factors, and the maturation of security technologies. This month has highlighted some clear trends: the continuous expansion of ransomware operations, the rise of insider threats, and an increasing reliance on automation to manage and counter ever-evolving attack vectors.

Evolving Role of CTI: From Data to Strategic Enabler

One of the most significant shifts in CTI is its role as a strategic enabler, moving beyond simply producing reports of indicators of compromise (IOCs) to becoming embedded across an organization’s decision-making processes. CTI is now expected to provide actionable intelligence that feeds directly into Security Operations (SecOps), vulnerability management, and strategic planning. This shift has been driven by the rise of Continuous Threat Exposure Management (CTEM), a framework that ensures a real-time, proactive stance in monitoring and mitigating risks.

Threat intelligence is no longer a reactive discipline; it is an integral component of overall cyber resilience. Organizations are using CTI not just for immediate incident response but to understand the broader attack surface, prioritize critical assets, and make investment decisions in security technologies​(Cybersixgill)​(ThreatConnect).

Ransomware: The Persistent and Adaptable Threat

Ransomware remains a dominant threat in 2024, with new tactics and vulnerabilities being exploited almost daily. Among the more significant developments has been the adaptation of Akira ransomware, which has exploited critical vulnerabilities in SonicWall SonicOS. These vulnerabilities, specifically CVE-2024-40766, allow attackers to compromise SSLVPN access, particularly in systems with weak or outdated configurations. Akira’s ability to exploit both Windows and Linux environments through its Ransomware-as-a-Service (RaaS) model continues to make it one of the most adaptable and dangerous ransomware families this year​(SOCRadar® Cyber Intelligence Inc.)​(SC Media).

Moreover, phishing remains a key method for initial access, accounting for over 32% of ransomware incidents. It has evolved with more sophisticated techniques like spear-phishing and MFA-bypass, targeting both individuals and organizations​(Kroll). The availability of decryption tools, like the one released by Avast, provides some relief for victims, but Akira’s operators are quick to patch their code, ensuring their malware remains effective​(BleepingComputer).

Insider Threats: The Quiet Danger

Insider threats have emerged as a growing concern, particularly in industries with high-value intellectual property, such as manufacturing and technology. These threats accounted for 29% of initial access vectors in recent incidents​(Kroll). Whether malicious or negligent, insiders—often with authorized access—can cause significant damage by leaking credentials or inadvertently exposing critical systems to external attackers.

As organizations adopt hybrid work models and expand their use of cloud services, monitoring and mitigating insider risks becomes more complex. CTEM is increasingly leveraged to provide continuous monitoring, enabling organizations to detect unusual patterns of behavior and prevent these internal risks from escalating​(Cybersixgill)​(The Security Validation Platform).

Supply Chain Vulnerabilities: A Growing Concern

The risk posed by supply chain vulnerabilities is another significant trend, exacerbated by the complexity of today’s global, interconnected systems. Attackers are targeting third-party vendors and service providers, recognizing that a breach in one part of the chain can cascade into multiple organizations. Supply chain attacks are particularly prevalent in sectors like financial services and manufacturing, where attackers exploit relationships between vendors to gain initial access​(Silobreaker).

One such example is the targeting of cloud misconfigurations or vulnerabilities in widely-used tools such as VMware or SonicWall, which attackers use to pivot from the vendor’s system into customer networks. This trend underlines the need for organizations to better assess their third-party risk management strategies and ensure tighter controls around vendor access​(SC Media).

Automation and AI: The Future of Threat Intelligence

The complexity of the modern threat landscape has led to an increased reliance on automation and AI-driven tools to process vast amounts of data and respond to threats in real time. SIEM and SOAR platforms now integrate threat intelligence directly into security workflows, enabling faster detection and response to incidents​(Expert Beacon).

These platforms are especially valuable in managing the noise generated by multiple threat feeds. By filtering out false positives and providing only relevant, actionable intelligence, they allow security teams to focus on real threats. The integration of AI and machine learning enhances these systems by enabling predictive analytics, allowing security teams to anticipate and mitigate attacks before they happen​(Rapid7).

Geopolitical Factors Driving Cyber Attacks

Cyberattacks are increasingly influenced by geopolitical events. State-sponsored actors are taking advantage of global tensions to launch cyber-espionage and disruption campaigns. Attacks against critical infrastructure—particularly in the energy and defense sectors—have risen sharply in 2024​(Silobreaker).

Recent analysis shows a surge in state-affiliated APT groups using ransomware as a cover for espionage activities, often leveraging vulnerabilities in widely-used systems like SonicWall and VMware to access sensitive governmental and corporate networks​(BleepingComputer)​(BleepingComputer).

Further Reading

For more in-depth analysis and updates on current cyber threat trends, consider the following resources:

1. SonicWall Vulnerability Analysis – BleepingComputer​(BleepingComputer).
2. Akira Ransomware Profile – SC Media​(SC Media).
3. CrowdStrike 2024 Global Threat Report – CrowdStrike.
4. CTI Trends in Supply Chain Risk – Silobreaker​(Silobreaker).
5. CTEM and Insider Threat Insights – Palo Alto Networks​(The Security Validation Platform).