DarkOwl Reviews 2021 Darknet Security Events and Forecasts 2022 Trends
Summary
DarkOwl reviews 2021 darknet-related security developments, including ransomware, supply-chain attacks, access brokers, healthcare threats and cyber conflict, and forecasts which trends may continue or escalate in 2022.
Key points
- DarkOwl says ransomware groups used backdoors to maintain access, while researchers demonstrated potential SSD firmware-area abuse; the article notes no such SSD attacks had been observed in the wild.
- The roundup describes major supply-chain incidents involving Kaseya and Log4Shell, and notes DarkOwl found Log4j exploit offers on darknet forums.
- DarkOwl observed growth in access-as-a-service and data brokerage, including domain administrator credentials offered for sale.
- The article reports that REvil’s Tor sites went offline after the FBI compromised server backups, while LockBit expanded and more than a dozen new RaaS groups emerged, according to DarkOwl.
- DarkOwl reports ransomware-related healthcare impacts and darknet offers for medical data; it also describes unemployment and COVID-related fraud offers.
- The Colonial Pipeline attack used credentials for an old VPN account reportedly found on the darknet; the shutdown caused fuel shortages and economic impacts.
- DarkOwl says Tor Browser 11.0.1 made historical v2 onion services inaccessible and estimates more than 64,000 active domains disappeared; it expects interest in alternative anonymous networks to grow.
Article Details
- Event Type
- Retrospective of major darknet-related cybersecurity events and threat trends observed in 2021, with forecasts for 2022.
- Impact
- Reported events included ransomware and supply-chain attacks, data exposure affecting healthcare organizations, disruption of critical infrastructure, and growth in darknet criminal services and marketplaces. The Colonial Pipeline shutdown caused fuel shortages across the Southeastern United States and increased fuel prices. The article also describes the shutdown of REvil operations, the emergence of new ransomware groups, and cyberattacks associated with tensions between Iran and Israel.
People
Threat Actors
BlackShadowNamed as a possible affiliation of Moses Staff; the article also reports that Israel’s Cyber Unit shut down its websites after it leaked an Atraf user database.ContiRaaS gang whose arsenal was assessed to include the Trickbot botnet.DarkSideRaaS organization identified as carrying out the Colonial Pipeline ransomware attack.DiavolRaaS gang whose arsenal was assessed to include the Trickbot botnet.LockBitRaaS group reported to have taken on surviving REvil affiliates and increased its operations.Moses StaffRansomware group reported to attack targets in Israel without demanding ransom; described as likely affiliated with Pay2Key and/or BlackShadow.Pay2KeyNamed as a possible affiliation of Moses Staff; the article does not establish the relationship.REvilRaaS group reported to have exploited Kaseya VSA software updates and later shut down after the FBI compromised its server backups.
Malware
Phoenix LockerThis year, we witnessed cyber insurer, CNA become a victim of ransomware after Russian criminals encrypted their network with the Phoenix Locker.TrickbootDubbed as “Trickboot,” this backdoor operative infects the UEFI/BIOS bootkit.TrickBotOne of the most noteworthy examples of this is the widely known botnet Trickbot, which was weaponized and has since been assessed as the arsenal’s of Conti and Diavol RaaS gangs.
Vendors
Products
Apache Log4jLuckily, developers appear to have won the race to patch an Apache log4j vulnerability, with CISA officially stating that other than an attack against the Belgium Ministry of Defence, most log4Shell type-attacks haveTor Browser BundleAfter the Tor Project released version 11.0.1 of the Tor Browser Bundle, all historical onion services were no longer accessible from the web browser.
Countries
Belgiumpatch an Apache log4j vulnerability, with CISA officially stating that other than an attack against the Belgium Ministry of Defence, most log4Shell type-attacks have had minimal impact, e.g. cryptomining, etc.Iran11. Iran and Israel Continue Shadow Cyber WarIsrael11. Iran and Israel Continue Shadow Cyber WarUnited StatesThe shutdown caused shortages of fuel across the Southeastern United States and resulted in increased fuel prices and economic impact for months afterwards.
Industries
Critical infrastructure9. Colonial Pipeline Ransomware Attack Highlighted Critical Infrastructure RiskCyber insuranceA decade ago, we had no construct of the concept of “Cyber Insurance”, nor ever thought such a policy would ever be required.Healthcare6. Attacks Against Healthcare Organizations by Cyber Criminals and RaaS Groups Despite Claims They Would Not Target Medical Industry