{"id":23852,"date":"2022-12-15T22:49:24","date_gmt":"2022-12-15T22:49:24","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/15\/unit-42-highlights-threat-intelligence-importance-as-russia-ukraine-ransomware-attacks-fly-under-the-radar\/"},"modified":"2022-12-15T22:49:24","modified_gmt":"2022-12-15T22:49:24","slug":"unit-42-highlights-threat-intelligence-importance-as-russia-ukraine-ransomware-attacks-fly-under-the-radar","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/15\/unit-42-highlights-threat-intelligence-importance-as-russia-ukraine-ransomware-attacks-fly-under-the-radar\/","title":{"rendered":"Unit 42 highlights threat intelligence importance as Russia, Ukraine ransomware attacks fly under the radar"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

As threat actors continue to become more sophisticated, staying ahead of the curve is a game-changer.<\/p>\n

Threat intelligence is now more important than ever, because a perfect storm is brewing based on ransomware attacks between Russia and Ukraine, with nation-state actors undertaking significant cyber espionage work undetected, according to Wendi Whitmore<\/a> (pictured), senior vice president for Unit 42 at Palo Alto Networks Inc.<\/p>\n

\u201cWhen it comes to just\u00a0general espionage techniques, data exfiltration, intellectual property theft,\u00a0those are going on now more than ever,\u201d she said. \u201cWe\u2019re under the landscape of a major war going on\u00a0between Russia and Ukraine of ransomware attacks. That\u2019s one of the key reasons why having threat intelligence is so important. It\u2019s become even more important now,\u00a0because these groups switch teams more frequently\u00a0than NFL trades.\u201d<\/p>\n

Whitmore spoke with theCUBE industry analysts\u00a0Lisa Martin<\/a>\u00a0and\u00a0Dave Vellante<\/a>\u00a0at\u00a0Ignite \u201922<\/a>, during an exclusive broadcast on theCUBE, SiliconANGLE Media\u2019s livestreaming studio. They discussed how threat actors keep on innovating and the importance of threat intelligence in mitigation purposes.\u00a0(* Disclosure below.)<\/em><\/p>\n

Extortion is going through the roof<\/h3>\n

Bad actors have mastered the art of extortion through new means, such as customer service, because decryption has become painstaking and time-consuming, according to Whitmore, who said that this has seen a surge of victims on leak sites.<\/p>\n

\u201cWe have a stat in our ransomware\u00a0threat report that talks about how often\u00a0victims are posted on leak sites, and I think it\u2019s\u00a0once every seven minutes,\u201d she said. \u201cSo what they\u2019ve really looked to do now is extortion, where they simply steal the data and then threaten to post it on these leak sites. That\u2019s really a blending of these techniques\u00a0of traditional cyber espionage with intellectual property theft. One of the other areas that they pride themselves on\u00a0is customer service.\u201d<\/p>\n

Nation-state actors\u2019 landscape has changed because they go beyond targeting government agencies and research institutions because enterprises are on their radar, Whitmore pointed out. This has emerged based on the convergence notion.<\/p>\n

\u201cOne of the interesting things that I think is occurring is this idea of convergence,\u201d she stated. \u201cTraditionally, if we looked at a nation-state actor,\u00a0like China or Russia, they were very specific about the types of victims. Now what we\u2019re seeing actually is those same attackers going towards a much larger supply chain. SolarWinds is a great example of that, the Hafnium attacks towards Microsoft Exchange Server last year.<\/p>\n

Here\u2019s the complete video interview, part of SiliconANGLE\u2019s and theCUBE\u2019s coverage of\u00a0Ignite \u201922<\/a>:<\/p>\n