text: Source: From a IBM Security Study – Cost of Insider Threats: Global Report

text: Source: BDO

identifier: ENISA Threat Landscape 2020 - Identity Theft

text: From January 2019 to April 2020

text: Identity theft

text: ENISA Threat Landscape

text: Overview

text: Identity theft or identify fraud is the illicit use of a victim’s personal identifiable information (PII) by an impostor to impersonate that person and gain a financial advantage and other benefits. According to an annual security report, at least 900 international cases of identity theft or identity-related crimes were detected . The most significant incidents reported were:  the exposure of nearly 106 million American and Canadian bank customers’ personal information from the Capital One data breach incident in March 2019 ;  the exposure of 170 million usernames and passwords used by digital game developer Zynga in September 2019;  the stealing of 20 million accounts from the British audio streaming service Mixcloud ;  the compromise of 600,000 drivers and 57 million users personal information from Uber’s data breach incident in November 2019;  and the theft of 9 million personal records from EasyJet customers including identity cards and credit cards. The trend of identity theft is reflected to a great part in data breaches, which, compared with 2018, saw a record number of 3.800 publicly disclosed cases, 4,1 billion records exposed and an increase of 54% in the number of breaches reported. __Findings The average cost for The annual cost for credential theft credential theft

text: $493,093 $2,79M

text: The frequency of incidents Percentage of incidents per company in 2019 relating to negligence

text: 3.2 63%

text: _The identity theft threat In 2019, some malicious actors behind major incidents from the past years were brought to justice. In June, the New York Police Department, in collaboration with the FBI, brought to justice the members of the ‘Fraud Ring’, who operated inside and outside the United States and managed in 2012 to steal credentials from iPhones worth of US $1million (ca. €846.000) in a large-scale identity theft operation. Until the group was stopped, the total amount stolen reached US $19 million (ca. €16 million) . A month later, the ‘Equifax settlement’ was publicly announced5. Equifax was forced to agree to compensate the United States Federal Trade Commission, the Consumer Financial Protection Bureau, 48 states, District of Columbia and Puerto Rico over its 2017 data breach at the cost of at least US $575 million (ca. €487 million). Because of that data breach, which was ruled as ‘entirely preventable’, nearly 148 million American addresses and social security numbers were leaked. At the end of the year, Brazil fined Facebook in US $1,6 million (ca. €1,35 million) on behalf of Brazilian citizens for the Cambridge Analytica data leak.

text: Kill chain

text: Identity theft Reconnaissance Weaponisation Delivery Exploitation Step of Attack Workflow Width of Purpose Command & Actions on Installation Control Objectives The Cyber Kill Chain framework was developed by Lockheed Martin, adapted from a military concept related with the structure of an attack. To study a particular attack vector, use this kill-chain diagram to map each step of the process and reference the tools, techniques and procedures used by the attacker. MORE INFORMATION

text: Trends

text: _Brand impersonation attacks Consistent with the trend in 2018, certain brands are preferred in impersonation attacks because of their strong reputation. Although these brands - such as Microsoft (44%) and Amazon (17%) - continue to lead in the rankings of 2019 brand impersonation attacks, new additions such as the United States Internal Revenue Service (IRS) are notable. The sensitive information included in the Wage and Tax Statement (W-2) has always been appealing to impostors, who used an IRS impersonation in 10% of identity deception-based e-mails in this reporting year. As a result, valid W- 2 forms and standard US Individual Tax Return (1040) forms are available on the dark web at a cost ranging between US $1 and US $52. This material, combined with the Social Security Numbers (SSN) and birth dates, which are also available, allows any inexperienced hacker willing to invest an amount of US $1,000 (ca. €846) to legally access a United Statesbased bank account, file a false tax return, claim a refund and cash-out an investment that has doubled or tripled. According to the IRS Criminal Investigation, more than 10.000 individual tax returns with claims for refund of more than US $83 million (ca. €70 million) were potentially fraudulent. __The cycle of steps for the tax scam “Dirty Dozen” Cash-out into Access a USan EU-based based bank account account Use the cryptocurrency File a false tax “Dirty Dozen” on the dark return web Tax Scam Claim IRS Transfer the refund into the refund to US-based cryptocurrency account

text: Trends

text: _SIM-Swapping identities This technique has been used since 2016, targeting cryptocurrency holders. However, in 2019 the same technique was used against highprofile individuals or accounts with the intention of stealing the victim’s identity. A number of victims of SIM-swapping were recorded, such as Jack Dorsey (Twitter’s CEO), Jessica Alba (actor), Shane Dawson (actor), Amanda Cerny (actor, twice a victim), Matthew Smith (actor, four times victim) and King Bach (artist). SIM-swapping was also used massively in two cases; at Mozambique’s largest bank, where up to US $50.000 (ca. €42.300) were stolen from high profile business accounts, and in Brazil where 5.000 victims, mainly politicians, ministers and governors had their accounts hacked by an organized gang. _Gift cards used as a business e-mail compromise (BEC) trojan horse BEC attacks caused losses of billions of euros in 2019. In such incidents, the attackers impersonate a trusted individual, usually within the company, and the victim is tricked into making a financial transaction or divulging sensitive information, personal or corporate. In more than half of BEC attacks, the victim was lured into purchasing a gift card. During the purchase process, sensitive information such as bank account credentials was intercepted. The victim was also forced to send the gift card to the attacker, as an anonymous, irreversible and direct cash-out option. The average amount stolen per gift card reached US $1.500 (ca. €1.269). __Findings 20%_of identity deception attacks used compromised accounts 30%_of the attacks targeting C-level executives accounts were compromised using display name deception 65%_of BEC attacks lured victims to purchase gift cards €3,32_ million average cost of a data breach 95%_of the responders to a Eurobarometer survey saw identity theft as a serious crime

text: Trends

text: _Digital doppelgangers The anti-fraud technique ‘digital masks’ was exposed when more than 60.000 stolen digital identities appeared as a trading product on the darknet marketplace Genesis in April 2019. These doppelgangers were readily available to purchase at US $5 - $200 each. The owner of a doppelganger can more easily mimic a real user in an online shop or payment service, especially if this is combined with stolen logins and passwords. Apart from purchasing digital doppelgangers, new tools to assist the potential impersonator have appeared, such as the Tenebris browser, which embeds a generator allowing the unique fingerprints and digital masks to be developed. In recent years, skimmers, dumpster divers, hackers, administrator impersonators and phishers have been identified as the main groups behind the identity theft attacks. That list expanded in 2019 with the addition of vishers and smishers. Vishers phish via phone calls. Unlike telephone impersonators, vishers pretend to represent a well-known organisation and offer to assist the victim with a service, for example managing computer software, finances or a tax refund. Smishers send false SMS messages and, if the receiver replies, their device is directly hijacked or redirected to a phishing website. The figure below shows the top data types lost in 2019, where e-mail data accounts for the highest number of records lost or stolen. These numbers reveals the seriousness of the situation when considering that e-mails may contain personal, corporate and governmental sensitive information. __Top data types lost in 2019 Account 10% Credit Card 12% Address 13% Miscellaneous 18% Name 26% Password 59% Email 65% 0% 10% 20% 30% 40% 50% 60% 70% 8 Source: RiskBased SECURITY

text: Attack vectors

text: _ How  THE CLOUD AS AN ATTACK INTERFACE FOR CUSTOMERS’ DATA. In the reporting year, Amazon CloudFront, a content delivery network (CDN), was compromised. The websites hosted or linked to libraries on Amazon’s infrastructure were exposed, revealing externally loaded content, including credit card data.  PHISHING URL. The common malware URL techniques of domain squatting, domain shadowing and URL shorteners were used once again in 2019. In the last quarter of 2019, it was noted that 26% of the malicious domains used a secure certificate and one in three of those certificates was SSL. This trick interfered with the judgement of visitor’s who used to rely on the padlock icon in their browsers as a sign of security.  W2 SCAM. Another attack that targets companies and organisations’ records to access sensitive information is the W2 scam. The scam starts by spoofing an executive member of the finance or human resources department to obtain employees’ records. These records are then used for identity theft. The scam is named after the American W2 tax form used to report employee’s wages. This social engineering scam, although old (first reported in 2016 by IRS), has been consistently rising 9,17 by 10% every year in recent years.  NIMCY. In 2019, a spear-phishing tool, Nimcy was introduced by the group responsible for the Zebrocy malware family. It was developed using the Nim (formerly Nimrod) programming language, created by the same group of hackers. This new downloader and backdoor was used to steal login credentials, keystrokes, communications and files from diplomats, defence officials and ministry staff in the foreign affairs sector. The attackers seemed to focus on Central Asian governments, with a preference for Pakistan and India.  MOBILE THREATS. A rise in malicious mobile apps was noticed in 2019 and continued in 2020. Even widely used and trusted platforms such as Google Play were hosting apps aiming to steal credentials (e.g. Acesse SantaMobile, Modulo ID). However, the number of downloads was extremely low, showing that the potential victims were not fooled.  TROJAN-BANKER.ANDROIDOS.SVPENG.AK The eighth most popular mobile trojan and most popular mobile banking trojan, responsible for 1,75% and 16,85% of unique attacks respectively, mostly target victims’ bank credentials and two-factor authorization codes. The majority of this trojan’s victims are located in Russia, making it the top country in terms of share of users attacked by mobile banking trojans.  FORMJACKING. Formjacking was extremely common in 2018 but the number of attacks seemed to decrease considerably in the first quarter of 2019. However, starting in May with the attack an American healthcare provider and the theft of login credentials, the number of attacks continued to rise throughout the rest of the year. In that month an all-time high number of 1,1 million detections was recorded. The five countries with the most formjacking detections in 2019 were the United States (51,8%), Australia (8,1%), India (5,7%), the United Kingdom (4,1%) and Brazil (3,5%). The Megacart hacker group is strongly associated with most of the development of formjacking tools and the attacks on British .22 Airways, Newegg, Feedify and Ticketmaster

text: Mitigation

text: _Proposed actions  Avoid using the password manager provided by the browser. If one is needed, use an offline protected password manager.  Authenticate any sender of a request to transfer money by telephone or in person.  Do not share sensitive information such as patient records in handwritten notes to prevent their loss or misplacement. Digital files are better for data with a short lifetime and then they should be completely destroyed.  Use ‘threat hunting’ within your company to strengthen security plans. Threat hunting is conducted by skilled members of the security operation centre (SOC) team to proactively identify vulnerabilities and prevent threats exploiting them.  Use policies such as velocity-based rules to mitigate identity fraud, especially for payment card transactions. The machine data of valid transactions can provide sufficient information for optimal policy definition.  Use single-sign-on (SSO) authentication method, when available, which allows a user to access several applications with the same set of digital credentials. Its use is highly recommended to minimise the number of user accounts and stored credentials.  Install end-point protection by means of anti-virus programs but also block execution of files appropriately (e.g. block execution in the temp folder).  Multi-factor authentication is a security measure to overcome password hacking or loss and to ensure the success of the authentication process with multiple keys. Introducing adaptive Multifactor authentication optimise the authentication process based on the user’s behaviour and on the associated context.  Check URLs that are sent by e-mail or randomly visited based on their IP address, the ASN associated with the IP, the owner of the domain and the relation between this domain and others, before any further steps are taken.  Organisations using cloud services should have strong cloud security operations and preferably use an architecture of on-premises storage, private cloud storage and public cloud storage simultaneously to protect their customer’s personal information.  Enforce the use of strong and updated encryption methods such as TLS 1.3 (using ephemeral keys) for sensitive data to prevents hacking.  Adequately protect all identity documents and copies (physical or digital) against unauthorised access.  Do not disclose identity information to unsolicited recipients and requests by phone or e-mail or in person should not be answered.  Enforce the use of password protected devices, ensuring good quality of credentials, and secure methods for their storage.  Ensure good quality of credentials and secure methods for their storage in all used media.  Pay close attention when using public Wi-Fi networks, as fraudsters hack or mimic them. If one is used, avoid accessing sensitive applications and data. Use a trusted VPN service to connect to public Wi-Fi networks.  Check transactions documented by bank statements or received receipts regularly for irregularities.  Install content filtering to filter out unwanted attachments, mails with malicious content, spam and unwanted network traffic.  Enforce the use of data loss prevention (DLP) solutions.

text: References

text: 1. “2019 identity theft report released” July 31, 2019. ITIJ. https://www.itij.com/latest/news/2019identity-theft-report-released

text: 2. “Capital One data breach: What you can do now following bank hack” August 12, 2019. C|Net. https://www.cnet.com/how-to/capital-one-data-breach-what-you-can-do-now-following-bankhack/

text: 3. ”Cybercrime Diary, Vol. 4, No. 4: Who’s Hacked? Latest Data Breaches And Cyberattacks”. January 8, 2020. Cyber crime Magazine. https://cybersecurityventures.com/cybercrime-diary-q1- 2020-whos-hacked-latest-data-breaches-and-cyberattacks/

text: 4. “$19 million worth of iPhones stolen in massive identity theft scam” June 15, 2019. 9To5Mac. https://9to5mac.com/2019/06/05/19-million-worth-of-iphones/

text: 5. “Equifax to pay at least $575 million as part of FTC settlement “ July 22, 2019. C|Net. https://www.cnet.com/news/equifax-to-pay-at-least-575m-as-part-of-ftc-settlement/

text: 6. “2019 data breaches: 4 billion records breached so far” Norton. https://us.norton.com/internetsecurity-emerging-threats-2019-data-breaches.html

text: 7. “Q1 2019: Email Fraud and Identity Deception Trends” Agari. https://www.agari.com/insights/ebooks/2019-q1-report/

text: 8. “Data Breach QuickView Report, 2019 Q3 trends.” November, 2019. RiskBased SECURITY. https://pages.riskbasedsecurity.com/hubfs/Reports/2019/Data%20Breach%20QuickView%20Rep ort%202019%20Q3%20Trends.pdf

text: 9. “IRS issues 2019 annual report; highlights program areas across the agency” January 6, 2020. IRS. https://www.irs.gov/newsroom/irs-issues-2019-annual-report-highlights-program-areasacross-the-agency

text: 10. “Hackers Hit Twitter C.E.O. Jack Dorsey in a ‘SIM Swap.’ You’re at Risk, Too” September 5,

text: 2019. The New York Times. https://www.nytimes.com/2019/09/05/technology/sim-swap-jackdorsey-hack.html

text: 11. ”IT threat evolution Q2 2019” August 19, 2019. Kaspersky. https://securelist.com/it-threatevolution-q2-2019/91994/

text: 12. “Phishing Activity Trends Report” September 12, 2019. Anti-phishing Working Group. https://docs.apwg.org/reports/apwg_trends_report_q2_2019.pdf

text: 13. “The Cost of Insider Threats” IBM. https://www.ibm.com/downloads/cas/LQZ4RONE

text: 14. “APT trends report Q2 2019” August 1, 2019. Kaspersky. https://securelist.com/apt-trendsreport-q2-2019/91897/

text: 15. “Proof Point Q3 2019 threat report: Emotets return, rats reign supreme and more” Proof Point. https://www.proofpoint.com/us/threat-insight/post/proofpoint-q3-2019-threat-reportemotets-return-rats-reign-supreme-and-more

text: 16. ENISA Threat Landscape Report 2018. https://www.enisa.europa.eu/publications/enisathreat-landscape-report-2018

text: 17. “Q2 2019 Cryptocurrency Anti-Money Laundering Report” Cipher Trace. https://ciphertrace.com/q2-2019-cryptocurrency-anti-money-laundering-report/

text: 18. “Latest Quarterly Threat Report - Q1 2019” Proof Point. https://www.proofpoint.com/us/resources/threat-reports/latest-quarterly-threat-research

text: 19. “BDO’s Fall 2019 Cyber Threat Report: Focus on Healthcare” October, 2019. BDO. https://www.bdo.com/insights/business-financial-advisory/cybersecurity/bdos-fall-2019-cyberthreat-report-focus-on-health

text: 20. “IT threat evolution Q1 2019. Statistics” May 23, 2019. Kaspersky. https://securelist.com/itthreat-evolution-q1-2019-statistics/90916/

text: 21. “IT threat evolution Q3 2019. Statistics” November 29, 2019. Kaspersky. https://securelist.com/it-threat-evolution-q3-2019-statistics/95269/

text: 22. “FORMJACKING: How Malicious JavaScript Code is Stealing User Data from Thousands of Websites Each Month” August 2019. https://www.symantec.com/content/dam/symantec/docs/security-center/white-papers/istrformjacking-deep-dive-en.pdf

text: 23. “Tax Fraud & “Identity Theft On Demand” Continue to Take Shape on the Dark Web” VMWare. https://www.carbonblack.com/resources/threat-research/tax-fraud-identity-theft-dark-web/

text: Related

text: ENISA Threat Landscape Report The year in review A summary on the cybersecurity trends for the period between January 2019 and April 2020. READ THE REPORT ENISA Threat Landscape Report List of Top 15 Threats ENISAs’ list of the top 15 threats of the period between January 2019 and April READ THE REPORT 2020. ENISA Threat Landscape Report Research topics Recommendations on research topics from various quadrants in cybersecurity READ THE REPORT and cyberthreat intelligence. ENISA Threat Landscape Report Sectoral and thematic threat analysis Contextualised threat analysis between January 2019 and April 2020. READ THE REPORT ENISA Threat Landscape Report Emerging trends Main trends in Cybersecurity observed READ THE REPORT between January 2019 and April 2020. ENISA Threat Landscape Report Cyber Threat Intelligence overview The current state of play of cyberthreat intelligence in the EU. READ THE REPORT

text: About

text: Regulation (EU) No 526/2013


text: th threat landscape, descending from the 7 position in 2018.

text: th landscape, descending from the 10 position in 2018.

identifier: ENISA Threat Landscape 2020 - List of top 15 threats

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

serie: rapporter

text: ENEN From January 2019 to April 2020

type: rubrik

text: List of top 15 threats

text: ENISA Threat Landscape

text: Top threats

text: ENISA Threat Landscape Report #1 Malware

text: Analysis and trends of the malware threat between January 2019 and April 2020. st Malware ranked 1 in the threat

type: stycke

text: READ THE REPORT

text: ENISA Threat Landscape Report #2 Web-based attacks

text: Trend analysis of web-based attacks between January 2019 and April 2020. nd Web based attacks ranked 2 in the

text: READ THE REPORT

text: threat landscape, maintaining the same position from 2018.

text: ENISA Threat Landscape Report #3 Phishing

text: Trend analysis of the phishing threat between January 2019 and April 2020. rd Phishing attacks ranked 3 in the threat READ THE REPORT th landscape, raising from the 4 position in 2018.

text: ENISA Threat Landscape Report #4 Web application attacks

text: Analysis and trends of web application attacks between January 2019 and April th 2020. Web applications attacks ranked 4

text: READ THE REPORT

text: in the threat landscape descending from rd the 3 position in 2018.

text: ENISA Threat Landscape Report #5 Spam

text: Trend analysis of spam attacks between January 2019 and April 2020. Spam READ THE REPORT th ranked 5 in the threat landscape rising th from the 6 position in 2018.

text: ENISA Threat Landscape Report #6 DDoS

text: Trend analysis of DDoS attacks between January 2019 and April 2020. DDoS attacks th ranked 6 in the threat landscape, READ THE REPORT th descending from the 5 position in 2018.

text: Top threats

text: ENISA Threat Landscape Report #7 Identify theft

text: Analysis and trends of the identity theft threat between January 2019 and April th 2020. Identity theft ranked 7 in the threat READ THE REPORT th landscape, rising from the 13 position in 2018.

text: ENISA Threat Landscape Report #8 Data breach

text: Trend analysis of data breach attacks between January 2019 and April 2020. th Data breach ranked 8 in the threat

text: READ THE REPORT

text: ENISA Threat Landscape Report #9 Insider threat

text: Trend analysis of the insider threat between January 2019 and April 2020. th Insider threat ranked 9 in the threat

text: READ THE REPORT

text: ENISA Threat Landscape Report #10 Botnets

text: Analysis and trends of the identity theft threat between January 2019 and April 2020. BotNets attacks ranked 10th in the

text: READ THE REPORT

text: ENISA Threat Landscape Report #11 Physical manipulation, damage, theft and loss

text: Physical manipulation, damage, theft and th loss attacks ranked 11 in the threat

text: READ THE REPORT

text: ENISA Threat Landscape Report #12 Information leakage

text: Trend analysis of information leakage threat between January 2019 and April 2020. Information leakage attacks ranked READ THE REPORT th 12 in the threat landscape, descending th from the 11 position in 2018.

text: Top threats

text: ENISA Threat Landscape Report #13 Ransomware

text: Analysis and trends of the identity theft threat between January 2019 and April th 2020. Ransomware ranked 13 in the READ THE REPORT th threat landscape, rising from the 14 position in 2018.

text: ENISA Threat Landscape Report #14 Cyberespionage

text: Trend analysis of cyberespionage between January 2019 and April 2020. Cyberespionage ranked 14th in the threat READ THE REPORT th landscape, rising from the 15 position in 2018.

text: ENISA Threat Landscape Report #15 Crytojacking

text: Trend analysis of cryptojacking between January 2019 and April 2020. Cryptojacking th attacks ranked 15 in the threat landscape, READ THE REPORT th descending from the 13 position in 2018.

text: “During the next decade, cybersecurity risks will become harder to assess and interpret due to the growing complexity of the threat landscape, adversarial ecosystem and expansion of the attack surface.”

text: Related

text: ENISA Threat Landscape Report The year in review

text: A summary on the cybersecurity trends for the period between January 2019 and April 2020.

text: READ THE REPORT

text: ENISA Threat Landscape Report Main incidents in the EU and worldwide

text: Main cybersecurity incidents happening between January 2019 and April 2020.

text: READ THE REPORT

text: ENISA Threat Landscape Report Research topics

text: Recommendations on research topics from various quadrants in cybersecurity READ THE REPORT and cyberthreat intelligence.

text: ENISA Threat Landscape Report Sectoral and thematic threat analysis

text: Contextualised threat analysis between January 2019 and April 2020.

text: READ THE REPORT

text: ENISA Threat Landscape Report Emerging trends

text: Main trends in Cybersecurity observed

text: READ THE REPORT

text: between January 2019 and April 2020.

text: ENISA Threat Landscape Report Cyber Threat Intelligence overview

text: The current state of play of cyberthreat intelligence in the EU.

text: READ THE REPORT

text: About

text: _ The agency The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found at www.enisa.europa.eu. Contributors Christos Douligeris, Omid Raghimi, Marco Barros Lourenço (ENISA), Louis Marinos (ENISA) and all members of the ENISA CTI Stakeholders Group: Andreas Sfakianakis, Christian Doerr, Jart Armin, Marco Riccardi, Mees Wim, Neil Thaker, Pasquale Stirparo, Paul Samwel, Pierluigi Paganini, Shin Adachi, Stavros Lingris (CERT EU) and Thomas Hemker. Editors Marco Barros Lourenço (ENISA) and Louis Marinos (ENISA). Contact For queries on this paper, please use enisa.threat.information@enisa.europa.eu. For media enquiries about this paper, please use press@enisa.europa.eu. Legal notice Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. Copyright Notice © European Union Agency for Cybersecurity (ENISA), 2020 Reproduction is authorised provided the source is acknowledged. Copyright for the image on the cover: © Wedia. For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders. ISBN: 978-92-9204-354-4 DOI: 10.2824/552242

text: Vasilissis Sofias Str 1, Maroussi 151 24, Attiki, Greece Tel: +30 28 14 40 9711 info@enisa.europa.eu www.enisa.europa.eu

text: All rights reserved. Copyright ENISA 2020. https://www.enisa.europa.eu

type: vagledning

utgivare: enisa


text: MEGA cloud (NZ) suffered Verification.io (US) exposed Norsk Hydro (NO) a data breach exposing ca. 800 million records. victim of a

text: million emails and 21 ransomware attack. million passwords.

text: Websites and the national Mastercard (BE) suffered a Bulgarian (BG) TV broadcaster in Georgia data breach affecting ca. Personal Tax Revenue (GE) suffered a coordinated 90K customers in Europe. office suffered a data cyberattack. breach exposing PII from all adult citizens.

text: UniCredit (IT) victim of a Prosegur (SP) suffered a Austria’s Foreign data breach leaking 3M ransomware attack Ministry (AT) targeted 10 .11 12 records. disrupting its operation. by a cyberattack.

text: Facebook (US) reported a Thyssen-Krupp and data breach exposing 540 Bayer (DE) targeted M user records on exposed with espionage 4 5 servers. malware.

text: City Power (ZA) victim of a Five hospitals in Romania ransomware attack (RO) hit by Badrabbit disrupting the energy ransomware. supply in Johannesburg.

text: INA Group (HR) victim of ENTSO-E (BE) network Over 500K Zoom (US) ransomware attack. compromised, victim accounts found for sale 14 31 of an intrusion. in the dark web.

text:  The e-mail platform verifications.io , suffered a major data breach due to an unprotected MongoDB database. Data from over 800 million emails were exposed, containing sensitive information that included personally identifiable information (PII).

text:  The cloud hosting provider iNSYNQ experienced a ransomware attack that left customers unable to access their data for more than a week, forcing customers to rely on local backups.

text: TURLA_ The group was reported to have targeted Microsoft

text: Exchange e-mail servers in the education, government, military, research, and pharmaceutical sectors in more than 40 countries in 2019. APT27_ The group was reported to have compromised

text: government organisations’ SharePoint servers in two different countries in the Middle East. VICIOUS PANDA_ In April 2020, the Mongolian Public

text: Administration was allegedly targeted by the group. GAMAREDON_ The group, reportedly targeted the

text: Ministry of Defence of Ukraine in a spear-phishing campaign from December 2019.

text: tion political talia re

text: Industrial property and trade secrets are the most desirable assets because of their high value to their owners, the market and some cases the criminal world.

text: This asset includes any information that a state deems sensitive. In 2019, the trade and diplomatic tensions between countries made this type of information even more attractive.

text: Server infrastructure is the first sensitive asset that is not data. In many attacks, taking over the victim’s server infrastructure, is the primary objective.

text: Authentication data is valuable assets for generating profits but also as an objective to support an attack.

text: Financial data such as credit card, banking and payment information is always value to cybercriminals.

text: “MEGA Data Breach Exposed 773 Million Email Addresses and Passwords.” January 19, 2019.

text: Latest Hacking News. https://latesthackingnews.com/2019/01/19/mega-data-breach-exposed- 773-million-email-addresses-and-passwords/

text: “Largest Leak in History: Email Data Breach Exposes Over Two Billion Personal Records.” April

text: 8, 2019. CPO Magazine. https://www.cpomagazine.com/cyber-security/largest-leak-in-historyemail-data-breach-exposes-over-two-billion-personal-records/

text: “LockerGoga Ransomware Disrupts Operations at Norwegian Aluminum Company.” March 20,

text: 2019. Recorded Future. https://www.recordedfuture.com/lockergoga-ransomware-insight/

text: “Researchers find 540 million Facebook user records on exposed servers.” April 3, 2019. Tech

text: Crunch. https://techcrunch.com/2019/04/03/facebook-records-exposed-server/

text: “Winnti: Attacking the Heart of the German Industry” July 24, 2019. Web.br.

text: “Cyber-attacks against 5 hospitals in Romania. CCR’s website, also hacked” June 20, 2019.

text: Romanian Journal. https://www.romaniajournal.ro/society-people/cyber-attacks-five-hospitalsromania-ccr-website-hacked/

text: “Here’s how ransomware attacks like the one on CityPower work – and why some victims end

text: up paying criminals millions” July 25, 2019. Business Insider South Africa. https://www.businessinsider.co.za/ransomware-attack-on-citypower-johannesburg-why-victimspay-criminals-2019-7

text: “Breach Saga: Bulgarian Tax Agency Fined; Pen Testers Charged.” August 30, 2019. Bank Info

text: Security. https://www.bankinfosecurity.com/bulgaria-fines-tax-office-penetration-testerscharged-a-13000

text: “Breach Of Mastercard Loyalty Program Affected 90K Germans’ Data” August 23,

text: 2019.PYMNTS.com. https://www.pymnts.com/news/security-and-risk/2019/mastercard-loyaltyprogram-data-breach-germany/

text: “UniCredit confirms data breach” October 28, 2019. PrivSec Report.

text: “Prosegur Hacked: Spanish SOC Provider Hit by Ryuk Ransomware” November 28, 2019.

text: Computer Business Review. https://www.cbronline.com/news/prosegur-hacked-ransomware

text: “Serious cyber-attack' on Austria's foreign ministry” January 5, 2020. BBC.

text: “Croatia's largest petrol station chain impacted by cyber-attack” February 20, 2020. ZDNet.

text: “European power grid organization says its IT network was hacked” March 9, 2020.

text: Cyberscoop. https://www.cyberscoop.com/european-entso-breach-fingrid/

text: “Fullz House hackers pivot from phishing to Magecart card skimming attacks” November 26,

text: 2019. ZDNet. https://www.zdnet.com/article/fullz-house-threat-group-pivots-from-phishing-tomagecart-card-skimming-attacks/

text: “FBI warns of cloud based BEC attacks.” April 8, 2020. Info Security. https://www.infosecuritymagazine.com/news/fbi-warns-of-cloudbased-bec-attacks/

text: “Microsoft Alerts Healthcare to Human-Operated Ransomware” April 1, 2020. Dark Reading.

text: “Verification.io suffers major data breach.” March 15, 2019. PrivSec Report.

text: “Inside the Insynq attack: ‘We had to assume they were listening’” August 8, 2019. Accounting

text: Today. https://www.accountingtoday.com/news/inside-the-insynq-ransomware-attack-we-hadto-assume-they-were-listening

text: “Former GE Engineer and Chinese Businessman Charged with Economic Espionage and Theft

text: of GE’s Trade Secrets”. April 23, 2019.USA DoJ. https://www.justice.gov/opa/pr/former-geengineer-and-chinese-businessman-charged-economic-espionage-and-theft-ge-s-trade

text: “Airbus supply chain hacked in a cyberespionage campaign” September 27, 2019. CERT-EU.

text: “Lazarus group's 'AppleJeus' sequel targets cryptocurrency traders” January 10, 2020. The

text: Cyber-Security Source. https://www.scmagazineuk.com/lazarus-groups-applejeus-sequel-targetscryptocurrency-traders/article/1670446

text: “Russian Nation-State Group Employs Custom Backdoor for Microsoft Exchange Server” July 7,

text: 2019. Dark Reading. https://www.darkreading.com/application-security/russian-nation-stategroup-employs-custom-backdoor-for-microsoft-exchange-server/d/d-id/1334628

text: “Vicious Panda: The COVID Campaign” March 12, 2020. Check Point Research.

text: “Gamaredon APT Improves Toolset to Target Ukraine Government , Military” February 5,

text: 2020. Threat Post. https://threatpost.com/gamaredon-apt-toolset-ukraine/152568/

text: “Virus attacks Spain's defense intranet, foreign state suspected: paper” March 26, 2019.

text: Reuters. https://www.reuters.com/article/us-spain-security-cyberattack/virus-attacks-spainsdefense-intranet-foreign-state-suspected-paper-idUSKCN1R7115

text: “115 Million Pakistani Mobile Users Data Go on Sale on Dark Web” April 10, 2020. Rewterz.

text: “Your business hit by a data breach? Expect a bill of $3.92 million” July 23, 2019. ZDNet.

text: “Cyber Security Statistics for 2019” March 21, 2019. Cyber Defense.

text: “Georgia ‘I’ll Be Back’ Cyber Attack Terminates TV, Takes Down 15,000 Websites.” October 29,

text: 2019. Forbes. https://www.forbes.com/sites/daveywinder/2019/10/29/georgia-ill-be-back-cyberattack-terminates-tv-takes-down-15000-websites/#1a5746347a48

text: “Half a million Zoom accounts for sale on the dark web.” April 16, 2020. WeLiveSecurity by

text: ESET. https://www.welivesecurity.com/2020/04/16/half-million-zoom-accounts-sale-dark-web/

text: “ENISA COVID-19 Resources”. ENISA. https://www.enisa.europa.eu/topics/wfh-covid19

text: “Brno University Hospital in Czech Republic Suffers Cyberattack During COVID-19 Outbreak”

text: March 17, 2020. Security Magazine. https://www.securitymagazine.com/articles/91921-brnouniversity-hospital-in-czech-republic-suffers-cyberattack-during-covid-19-outbreak

text: “Most malware in Q1 2020 was delivered via encrypted HTTPS connections”. June 25. 2020.

text: Help Net Security. https://www.helpnetsecurity.com/2020/06/25/encrypted-malware/

text: “Malware statistics and facts for 2020” July 29, 2020. Comparitech.

text: READ THE REPORT

text: ENISAs’ list of the top 15 threats of the period between January 2019 and April READ THE REPORT 2020.

text: READ THE REPORT

text: Main trends in Cybersecurity observed

text: READ THE REPORT

text: between January 2019 and April 2020.

text: READ THE REPORT

text: A roadmap on the cooperation across CSIRTs in particular with national and governmental - law enforcement (LE) and the Judiciary.

text: READ THE REPORT

text: A study aiming at the analyses of the current operational Incident Response set-up within NISD sectors and identify the recent changes.

text: READ THE REPORT

text: An updated version of the "Challenges for National CSIRTs in Europe in 2016: Study on CSIRT Maturity" published by ENISA in 2017

text: READ THE REPORT

text: in ETL 2020

identifier: ENISA Threat Landscape 2020 - Main Incidents

title: ENISA Threat Landscape 2020 - Main Incidents

text: From January 2019 to April 2020

text: Main incidents in the EU and worldwide

text: ENISA Threat Landscape

text: Overview

text: The sophistication of threat capabilities increased in 2019, with many adversaries using exploits, credential stealing, and multistage attacks. The number of data breach incidents is still very high,

text: and the amount of stolen financial information and user credentials is growing. In some cases, the failure to patch a known vulnerability that has the potential to affect software or libraries in use - in a reasonable timeframe – may have serious repercussions.

text: During the past decade, malware has made ENISA’s list of top 15 threats, yet still many security systems are not able to detect this threat. For many years, malware was spread mainly through malicious

text: e-mail spam and more recently, using finely crafted phishing messages. Technology companies and e-mail providers alike invested in spam filters, improving the detection of malicious attachments. However,

text: adversaries are now innovating to increase their chances of reaching potential victims. Many of these innovations have paid back

text: to malicious actors during this period.

text: The COVID-19 pandemic has put healthcare organisations and professionals worldwide under pressure, and health has become one of the most critical sectors to protect against cyberattacks. The number of incidents involving ransomware targeting the healthcare sector was already high but increased during the pandemic.

text: __Top data breaches incidents

text: Cloud service MEGA 770 ElasticSearch Server Breach 108 Canva Data Breach 139 Chinese Job Seekers MongoDB 202 Indian Citizens MongoDB… 275 Dream Market Breach 620 Verifications.io Data Breach 808 0 200 400 600 800 1,000 millions of records

text: Timeline

text: 2019 _ January _ February _ March _ October _ September _ August 2020 _ November _ December _ January _ April _ May _ July _ June _ February _ March _ April

text: Most targeted sectors

text: _In the line of fire

text: The sectors most targeted sectors during this period were digital services, government administration and the technology industry. Attacks on digital service providers often serve as proxies to reach other, more attractive targets. In contrast, attacks on the technology industry allowed malicious actors to compromise the supply chain or look for vulnerabilities to exploit.

text: Over 770 million e-mail addresses and 21 million unique passwords were exposed in a popular hacking forum hosted by the cloud service MEGA . It became the most significant collection of breached personal credentials in history, named ‘Collection #1’.

text: The cloud and virtualisation provider Citrix was a victim of a targeted

text: cyberattack. To gain access to Citrix’s systems, the attackers exploited several critical software vulnerabilities such as CVE-2019-19781 and employed a technique called password spraying.

text: __Most targeted sectors

text: Digital Services_ Services such as e-mail, social and collaborative platforms and cloud providers were under attack during 2019. These were also used as proxies for further attacks.

text: Government Administration_ The financial

text: returns from ransoms paid makes the public sector one of the most attractive targets for ransomware attacks. Technology Industry_ The technology industry was under attack in 2019 mainly through supply chain attacks trying to compromise the development of software through zeroday exploits and backdoors attacks. Financial_ The number of incidents with financial organisations and not necessarily banks, increased substantially during the reporting period. Healthcare_ The number of attacks against the healthcare sector continues to grow.

text: Trends

text: _Across the board

text:  In 2019, intense trojan-activity was observed across the globe. Emotet and Agent Tesla were the most frequently and dangerous  malwares .   Phishing remained one of the most successful techniques for delivering malicious tools. Powerful phishing lures include phone scams, fake invoices, payments, quotations and purchase and sales orders.   Ransomware continues to generate substantial financial rewards for malicious actors. A recent study identified human-operated ransomware campaigns , in which adversaries employ credential theft and lateral movement methods traditionally associated with targeted attacks such as those from nation-state actors.  Card-skimming schemes have become a significant threat during 2019 and 2020 due to the increasing number of online shoppers.  Business e-mail compromise (BEC) is a growing threat as a result of the vast amount of credentials and personal information stolen during the last decade.  Companies experience an average of 12 credential-stuffing attacks each month, wherein the attacker is able to identify valid credentials.

text: __Findings 84%_of cyberattacks rely on social engineering 67%_of malware was delivered via encrypted HTTPS connections 230.000_new strains of malware every day 6_months in average is what it takes to detect a data breach of organizations experienced 71%_ malware activity that spread from one employee to another

text: Actors

text: Knowing who is responsible or attributing responsibilities to a person or a group for a cybersecurity incident is still a very daunting task and often a worthless exercise. Yet, from a threat intelligence perspective, it is essential to classify behaviours, understand the dynamics and modus operandi used by certain adversaries. This analysis often helps defenders to look for specific tracks and try to anticipate the next adversarial action.

text: The Lazarus Group for example, an allegedly state-sponsored advanced

text: persistent threat (APT) group, was reportedly more active during the reporting period in both financially and espionage motivated attacks. The group has been associated with several incidents, including the

text: AppleJeus campaign targeting cryptocurrency trading platform users

text: and their systems. Major incidents attributed to this group include:  hacking an Indian nuclear power plant and space research organisation in November 2019;  compromising a cryptocurrency trading app targeting exchange administrators in October 2019;  attacking automated teller machines (ATMs) and banks in India, identified in September 2019;  targeting Android users in South Korea through trojanised apps in the Google Play Store identified in August 2019.

text: __Most active actors

text: Organized crime

text: Other

text: Insider

text: System admin

text: 10% End user

text: Nation state

text: Motivations

text: While it is challenging to determine the primary motivation behind a cyberattack, we can still categorise them based on the outcome of the incident.

text: Financial: The number of incidents resulting in the theft of information, data and user credentials is the highest observed during the reporting period. In most cases, the intention is to steal data/information and sell it on the dark web. Other uses of this information/data to enable other types of attacks with a completely different outcome such as espionage or financial fraud, can also be identified. More than 620 million account details were stolen from 16 hacked websites and offered for sale on the popular dark-web marketplace Dream Market.

text: Espionage: This is a motive behind an increasing number of reported attacks, mainly due to ongoing geopolitical and commercial tensions. The number of incidents is not substantial, but their size and magnitude put it second in ENISA’s list of top 5 motivations. Some noteworthy incidents include that reported in April 2019, in which a General Electric’s employee and a Chinese businessperson were charged by the United States Department of Justice with economic espionage and theft of General Electric’s trade secrets. AgenceFrance Presse (AFP) reported that Airbus had fallen victim to a sophisticated cyber-espionage campaign. Attackers reportedly breached the IT systems of several of Airbus’s suppliers and, from there, penetrated the company’s IT systems.

text: Top five motivations: financial, espionage, disruption, political and retaliation. __Top motivations

text: The figure below shows that Financial is still the primary motive for the majority of cyberattacks. In some cases, multiple motivations can be identified within a single attack. For example, espionage, political, financial and disruption are often combined motives. Many incidents originate from automated systems and are delivered ‘as-a-service’, paid in cryptocurrency. These services include distribution of ransomware, command and control (C2), distributed denial of service (DDoS), spam and other illicit activities.

text: financial

text: Attack vectors

text: Cyberattacks take on average three steps to reach a victim’s valuable assets. When reviewing the most frequently used attack vectors, we must prioritise the entry point, course of action and action on assets. These are the most critical stages that should constitute distinct approaches in a defence strategy.

text: Entry point: During 2019, the techniques used most frequently to start

text: a cyberattack include brute force with stolen credentials, social engineering, configuration errors and exploitation of web applications. The exploitation of web applications, for example, was often used as an entry point because of the growing uptake of this type of application to transfer data to the cloud. Errors in cloud configuration and misuse of systems were essential entry point in a large number of incidents. The use of social engineering to plan an attack leverages from tools such as phishing and business e-mail compromise (BEC) . Other techniques less frequently but equally important are the exploitation of vulnerabilities (from unpatched systems and zero-days) and software backdoors, often used in more complex and sophisticated attacks.

text: Course of action: Installing malware is the technique most widely used

text: during the ‘course of action’ stage. Once installed, it helps the adversary to do reconnaissance, move around the victim’s systems and networks, install additional tools such as ransomware, steal data and communicate with a C2 server.

text: __ most desired assets by

text: Five

text: cybercriminals 01_Industrial property and trade secrets 02_State/military classified information 03_Server infrastructure 04_Authentication data 05_Financial data

text: Strategic intelligence

text: _What changed in the landscape with the covid-19 pandemic?

text: In 2019, ENISA continued mapping the threat landscape, helping decision-makers and policymakers define strategies to defend citizens, organisations and cyberspace. This work is part of ENISA’s strategy to provide strategic intelligence to its stakeholders. The central theme in 2019 was the next generation of mobile telecommunications, or 5G, following a request from the European Commission and Member States.

text: The agency will continue to produce these thematic threat landscapes and in 2020, the focus is on artificial intelligence.

text: The COVID-19 pandemic has been a prolific period for malicious actors conducting attacks targeting sensitive areas such as healthcare service providers and people working from home. ENISA is mapping the threat landscape experienced during the pandemic and advising on mitigation measures that will attempt to reduce the exposure to threats.

text: ENISA shares its cybersecurity recommendations on the COVID-19 pandemic on a variety of topics including working remotely, online shopping and e-health, and it provides valuable up to date security advice to the sectors affected.

text: The Brno University Hospital in the Czech Republic suffered a

text: cyberattack in the midst of the COVID-19 pandemic, which forced it to reroute patients and postpone surgery. The incident is considered critical since this Hospital is one of the Czech Republic's biggest COVID- 19 testing laboratories.

text: _COVID-19 threat landscape

text: ENISA prepared many resources for an awareness-raising campaign and shared other internal and external resources dedicated to cybersecurity experts, covering security issues associated with challenges faced during the COVID-19 pandemic. One of these resources was an analysis of the most critical threats during this period.

text: References Related

text: ENISA Threat Landscape Report The year in review ENISA Threat Landscape Report List of Top 15 Threats ENISA Threat Landscape Report Research topics ENISA Threat Landscape Report Sectoral and thematic threat analysis ENISA Threat Landscape Report Emerging trends ENISA Threat Landscape Report Cyber Threat Intelligence overview

text: RelatedOther publications

text: Roadmap on the Cooperation Between CSIRTS and LE EU MS Incident Response Development Status Report ENSIA CSIRT maturity assessment model “The sophistication of threat capabilities increased in 2019, with many adversaries using exploits, credential stealing, and multistage attacks.”

text: About

text: _ The agency

text: The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: Contributors

text: Christos Douligeris, Omid Raghimi, Marco Barros Lourenço (ENISA), Louis Marinos (ENISA) and all members of the ENISA CTI Stakeholders Group: Andreas Sfakianakis, Christian Doerr, Jart Armin, Marco Riccardi, Mees Wim, Neil Thaker, Pasquale Stirparo, Paul Samwel, Pierluigi Paganini, Shin Adachi, Stavros Lingris (CERT EU) and Thomas Hemker.

text: Editors

text: Marco Barros Lourenço (ENISA) and Louis Marinos (ENISA).

text: Contact

text: For queries on this paper, please use enisa.threat.information@enisa.europa.eu. For media enquiries about this paper, please use press@enisa.europa.eu.

text: Legal notice

text: Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: Copyright Notice

text: © European Union Agency for Cybersecurity (ENISA), 2020 Reproduction is authorised provided the source is acknowledged. Copyright for the image on the cover: © Wedia. For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders.

text: ISBN: 978-92-9204-354-4 DOI: 10.2824/552242


text: The Cyber Range concept was initially defined in 2013 by the European Defence Agency (EDA)

text: in the report “Common staff target for military cooperation on cyber ranges in the European Union” as a multipurpose environment in support of three primary processes: knowledge development, assurance and dissemination.

text: “ENISA threat landscape for 5G Networks”. November 21, 2019. ENISA.

text: in ETL 2020

text: A summary of the main cybersecurity trends for the year.

text: READ THE REPORT

text: ENISAs’ list of the top 15 threats of the period between January 2019 and April READ THE REPORT 2020.

text: Main cybersecurity incidents happening between January 2019 and April 2020.

text: READ THE REPORT

text: Contextualised threat analysis between January 2019 and April 2020.

text: READ THE REPORT

text: Main trends in Cybersecurity observed

text: READ THE REPORT

text: between January 2019 and April 2020.

text: The current state of play of cyberthreat intelligence in the EU.

text: READ THE REPORT

text: A roadmap on the cooperation across CSIRTs in particular with national and governmental - law enforcement (LE) and the Judiciary.

text: READ THE REPORT

text: A study aiming at the analyses of the current operational Incident Response set-up within NISD sectors and identify the recent changes.

text: READ THE REPORT

text: An updated version of the "Challenges for National CSIRTs in Europe in 2016: Study on CSIRT Maturity" published by ENISA in 2017

text: READ THE REPORT

text: in ETL 2020

text: Vasilissis Sofias Str 1, Maroussi 151 24, Attiki, Greece Tel: +30 28 14 40 9711 info@enisa.europa.eu www.enisa.europa.eu

text: All rights reserved. Copyright ENISA 2020. https://www.enisa.europa.eu

identifier: ENISA Threat Landscape 2020 - Research topics

text: ENEN From January 2019 to April 2020

text: Research topics

text: ENISA Threat Landscape

text: Overview

text: New concepts and ideas are evolving in the cybersecurity domain due to research and innovation activities conducted by academics, industry and professionals around the world. These are important steps since the pace of innovation from adversaries (e.g. malicious actors) is higher than the one from cybersecurity specialists finding solutions to deter them. In fact, apart from basic cybersecurity hygiene and training, investing in research and innovation is the most viable option for defenders to come closer to what is required to improve the security of cyberspace. In this report, we highlight some of the most important cybersecurity research and innovation topics explored in the EU and around the world.

text: _ Better understanding of the human dimension

text: Cybersecurity is still seen as the practice of protecting networks, information systems and data (NIS). This definition needs to be further expanded beyond technical issues to include socio, behavioural and economic concerns and the different roles performed by the parties involved. This should constitute a priority in future cybersecurity research and innovation discussions. A better understanding of the human dimension is key in the definition of any cybersecurity strategy so that security decisions are taken to meet their needs, skills and expectations.

text: _ Cybersecurity research and innovation

text: During 2019, we observed an increase in the number of test labs and cyber-ranges becoming available on-premises and in cloud offerings. These are essential resources for researchers to simulate attacks, develop exploitation scenarios, obtain operational data and test defence strategies in a multipurpose virtual environment. However, existing testing environments lack on replicating many vulnerabilities that typically compromise security such as human and engineering factors, among others. To improve efficiency, it is import to research and innovate the scope and fidelity of these test labs and propose new technical solutions.

text: Overview

text: _ 5G security

text: The rollout of 5G mobile networks in some countries started in 2019 but the expectation is for the number of installations to increase in 2021. This next generation of mobile communications is of paramount importance for the social and economic progress of the European Union. Hence, the future research and development of 5G security solutions is crucial for the sustainability and reliability of this technology. In 2019, ENISA published a threat landscape for 5G networks reviewing some critical security aspects related with this emerging technology. Key topics in research and innovation of 5G security should consider the following aspects.

text:  The research and development of security controls to cover the protection of the network, physical elements and data layers, thus providing a multi-layer protection solution. With 5G Networks, data will be located in centralized cloud servers, intermediate fog nodes, and edge devices, increasing complexity in the implementation of a security solution.

text:  The research and development of standards and requirements for security controls to implement across interconnected networks with multiple owners, topologies, operators, and a diversified variety of devices and network layers.

text:  The research and development of key management capabilities enabling secure interoperability between nodes connecting resource-limited edge and IoT devices. This capability should include effective access control, authentication, cryptography, and key management techniques to limited-resource nodes.

text: _ EU research and innovation projects on cybersecurity

text:  The EU is working to establish a pilot for a cybersecurity competence 3 4 5 6 network. CONCORDIA , ECHO , SPARTA and CyberSec4Europe are the four winning pilot projects of the 2018 Horizon 2020 cybersecurity call for ‘establishing and operating a pilot for a European Cybersecurity Competence Network and developing a common European Cybersecurity Research & Innovation Roadmap’. The EU expects to strengthen its cybersecurity capacity and address future cybersecurity challenges with these four pilot projects, for a safer EU Digital Single Market.  The EU grants €38 million for protection of critical infrastructure against cyber threats. The European Commission has announced that it is committing more than €38 million through Horizon 2020 to the EU’s research and innovation programme. The program is meant to support several innovative projects in the field of protection of critical infrastructure against cyber and physical threats and making cities smarter and safer.  The EU launched a €10.5 million call for projects in cybersecurity. The Commission has launched a new call worth €10,5 million through the Connecting Europe Facility (CEF) programme for projects that will work on stepping up Europe’s cybersecurity capabilities and cooperation across member states.

text: CTI research and innovation

text: _ Rapid dissemination of CTI methods and content

text: Various research needs were identified during the reporting period and the actions to address these needs are proposed here. These have been grouped into some categories to better reflect the scope better. Though not overlap-free, these categories are indicative for areas of potential CTI improvements.

text:  The results of research projects in the area of CTI need to be

text: assessed and mapped to a broader CTI context to identify overlaps

text: and gaps and to make them comparable with existing CTI commercial products, services and practices. This will help to disseminate the results to the user community. At the same time, existing gaps will be filled by additional functions, content and processes. EU (Horizon H2020) projects with CTI relevance are excellent candidates for this task, contributing to improving CTI practices.  The provision and use of open-source CTI material should be

text: promoted. This will facilitate knowledge transfer, but it will also lower

text: the threshold of CTI skills. Open-CTI is the perfect candidate for this purpose, as it supports the ingestion of CTI from multiple sources into a single base that can be shared among various users, while at the same time offering a set of functions for managing this information. By adopting Open-CTI, users will be in a position to obtain valuable information at a relatively low skill threshold.

text: _Research resulting in emerging trends

text: The need to strengthen CTI with other established cybersecurity

text: tools requires the structural and contextual evolution of this domain. At the same time, technological advances brought by emerging technologies pose the question of how CTI can benefit

text: from these developments. Thus, prospective research needs in

text: the area of CTI will contribute to improving processes, functions, automation, content structure and validation, service delivery, speed-to-user/dissemination, CTI deployment and mappings.

text: CTI research and innovation

text: _ Functionality, level of automation and compliance with maturity requirements

text:  Process automation will assume a key role in CTI. While modern cyberattacks have become heavily automated, organisations try to defend themselves against them manually or by partially using automation. This is an unequal contest, which slows down the speed and capability of responding. Investigating the potential automation of CTI processes will be vital for striking a balance between attackers and defenders. Achieving this will need a thorough analysis of CTI process steps and options for automating these steps via available and emerging technologies.  CTI maturity requirements will need to be identified in further

text: detail. Although some criteria/requirements for the selection of CTI

text: functions (e.g. Threat Intelligence Platforms or TIPs) have been developed for various CTI user profiles, similar requirements will be necessary for further CTI products, services and tools. Such requirements will be associated with multiple levels of user maturity and expenditure and types of CTI. Similar criteria/requirements are necessary for various other elements of a CTI infrastructure, such as tools, good practices, sharing platforms, etc. Hence, apart from the development of CTI capability maturity models, research is needed to show how CTI functions correspond to the various CTI maturity levels. This work will contribute to increasing the speed of adoption of CTI practices.  The use of AI/ML in CTI should be further investigated. This will reduce the number of manual steps in CTI analysis and will increase the value of ML functions within CTI activities.

text: _ Building bridges to related areas

text:  Novel approaches for the ingestion of CTI knowledge by domains that can profit from it need to be developed. Examples are cyberranges, hybrid threats, supply chains and geopolitical assessments and crises. Questions to be asked in this respect include: What are the points at which CTI can be taken into account? Which CTI content is relevant? What are the validation criteria for the appropriateness of CTI information? How can CTI be ‘hooked’ into information about the domain concerned? What kind of information from those domains can be added to CTI? The synergies reflected in these questions may boost use-cases and content quality in an omnidirectional manner.

text:  CTI is essential for a number of disciplines. Examples include risk assessment/management and the definition of protection requirements and certification. It will be beneficial for those disciplines to use CTI in the correct way. CTI contribution to these disciplines can be identified using information, such as threat models, threat actor information (capabilities, motives), attack methods and exploits. Although some relevant material does exist (e.g. ATT&CK attack framework ), significant work is required in order to identify and standardise such information interfaces.

text: CTI research and innovation

text: _ Effectiveness of CTI operations

text:  Methods for using CTI effectively will be a tool for decision-

text: making. Such methods of deploying CTI efficiently will help decision-

text: makers to understand the value of CTI and practitioners to evaluate the return-on investing in CTI. Such methods/KPIs will need to consider factors beyond the CTI content, taking into account improvements achieved within the entire life cycle of security management and risk mitigation. Optimally, measuring the effectiveness of investment in CTI will be part of a much wider consideration of the economics of cybersecurity in various kinds of organisations (e.g. according to security requirements, maturity levels, etc.).

text:  Although low-cost tools prevail for aggregating, analysing and

text: disseminating CTI, some research may be necessary to find automated tools for managing the CTI consumed and produced.

text: Other than standardised data formats (e.g. CSV files, STIX, TAXII), standard CTI functions may be the subject of such research, followed by the development of low-cost, open-source tools supporting such functions.

text: _ Evolution of CTI structure and content

text:  As CTI is penetrating additional domains, information from these

text: contexts needs to be fed back to the original CTI knowledge base. For example, CTI structures need to be defined to capture

text: geopolitical and hybrid-threat information. The same applies to the relevance of CTI for risks, incidents, forensic analyses, assurance levels, etc. The existing CTI formats need to evolve to capture information emanating from these dependencies in CTI.

text:  Emerging technologies such as AI may be used to validate of analysed CTI. Such tools may augment or even replace manual CTI analysis, but also provide support throughout the life cycle of CTI (e.g. check the relevance of CTI based on existing incident information). Such novel approaches to CTI will enhance the quality and relevance of the information.

text: References

text: “CTI has been firmly established in the cybersecurity domain as an essential tool for enhancing agility and efficiency in defending cyberattacks.”

text: Related

text: ENISA Threat Landscape Report The year in review ENISA Threat Landscape Report List of Top 15 Threats ENISA Threat Landscape Report Main incidents in the EU and worldwide ENISA Threat Landscape Report Sectoral and thematic threat analysis ENISA Threat Landscape Report Emerging trends ENISA Threat Landscape Report Cyber Threat Intelligence overview

text: RelatedOther publications

text: Roadmap on the Cooperation Between CSIRTS and LE EU MS Incident Response Development Status Report ENSIA CSIRT maturity assessment model “The sophistication of threat capabilities increased in 2019, with many adversaries using exploits, credential stealing and multistage attacks.”

text: About

text: _ The agency

text: Contributors

text: Editors

text: Contact

text: Legal notice

text: Regulation (EU) No 526/2013

text: Copyright Notice