Introduction

Strategic Context: An Unsettled World

Interpreting the data in this report requires understanding “the bigger picture” on a global scale. That’s because cyber threats to organizations worldwide don’t occur in a technical vacuum. Among the major drivers of cyber risk are wars and other forces majeures, large-scale shifts in economic cycles, and new vulnerabilities that can emerge any time a team introduces changes to factors such as business models, key partners, core processes, technology adoption, and regulatory compliance. A sampling of factors influencing our Q1 2023 threat data includes:

• Russia’s Invasion of Ukraine and Asymmetric Warfare Against the West: Cyberactivity for the purposes of espionage, warfare, and disinformation in service of political, economic, and territorial ambitions from major nation-states continues to escalate. Hackers are levying increasingly sophisticated cyberattacks against Western businesses, governments, and infrastructure.
• Xi Jinping’s Consolidated Control over China and its Geopolitical Aspirations: China’s nationalist goals, assertive foreign policy, and corporate espionage practices continue to drive cyber risks as China-affiliated advanced persistent threat (APT) groups dominate the global landscape.
• Developing Economies and Rapid Infrastructure Expansion: As many developing regions scale up infrastructure and technology as their economies grow, cybersecurity is often not top-of-mind – leading to many cyber-related vulnerabilities in critical infrastructure. 
• Global Inflation and its Economic and Political Impacts: This quarter included market volatility, financial and political crises, and pressures on spending priorities and cybersecurity budgets.
• Continued Post-COVID Supply Chain Disruptions: New paths to market across regions required shifts in partners, transportation networks, information sharing, and – by extension – cyber risk. Because cyber threats are impacting the supply chain daily, the need for zero-trust capabilities remains strong across industries. 
• The Myth of Apple’s Superior Security Environment: This persists despite the fact that MacOS environments can no longer be considered safe as threat actors start to leverage Golang-based malware at scale and broaden attack vectors to cover numerous operating systems. 
• Artificial Intelligence Arrives on the World’s Stage – and Promising Disruption: Cyber defense is helped and hurt by enhanced machine learning, natural language processing, and other advances. But as global cyber threats are evolving and occurring at a scale far faster than human teams can manage, artificial intelligence solutions become vital for enterprises’ cyber defense.

Cybersecurity: CISO Challenges and the SecOps Revolution

Q1 2023 Highlights At-a-Glance

The Ransomware Landscape

• The Ransomware Wave: Ransomware continues to be king as the primary type of cyberattack across the globe. Socially engineered ploys to deceive and manipulate individuals into divulging confidential or personal information, such as phishing, are more prevalent than ever even as they become more sophisticated.
• Cuba and Play Dominate: Though we observed a decline in ransom-related cybercriminal activity at the start of the year, the most prevalent ransomware families in Q1 were Cuba (9%) and Play (7%).
• LockBit Lingers: Despite a reduction in activity two quarters in a row, LockBit continues to be the most aggressive ransomware in pressuring its victims to comply with ransom demands.
• Magecart Group Potential on the Rise: Public reporting indicates this credit card theft and ecommerce scalping group’s activity in Q1 2023 increased tremendously. This threat rarely operates at the same scale of activity as the other major nation-state-affiliated APTs – potentially indicating a re-emergence of Magecart Group worldwide. 

Ransomware Tactics Evolving

• Monetary Objectives: It’s unsurprising that the motivations for ransomware remain primarily financial; the insurance (20%) and financial services (17%) sectors logged the most detections of potential attacks. 
• Mid-Size Businesses Most Impacted: Evaluation of on leak site data reveals the victims from these attacks are most commonly mid-sized businesses with only 51 to 200 employees (32.3%) and $10M to 50M in revenue (38.3%). 
• United States as Primary Target: The U.S. (15%) was the country most affected by ransomware groups. It was also the country with the highest percentage of corporate victims (48%) who decided to “buy their data back” from the attackers – a rate six times greater than the next nation on the list, the United Kingdom.
• Cobalt Strike as the Weapon of Choice: Trellix telemetry identifies this tool as heavily favored by ransomware actors (28% of incidents). It appears to be growing in popularity and usage amongst these groups despite vendor Fortra’s attempts in late Q4 2022 to make it harder for threat actors to use it.

Nation-State Red Flags

• Leading Actors: For the last six months, APT actors linked to China, including Mustang Panda and UNC4191, were the most active in targeting nation-states in Q1. China-affiliated threat actors dominated the global scene, generating 79.3% of all nation-state activity, followed by actors tied to North Korea, Russia and Iran. 
• Most Active APT Group: Mustang Panda persisted for the third quarter in a row as the most active APT group worldwide (72%) – denoting China’s continued and growing malicious cyber efforts for the purpose of espionage and disruption. 

Vulnerability Intelligence

• Failure to Address Known Vulnerabilities: Most of this quarter’s most critical vulnerabilities consisted of known vulnerabilities not yet addressed.
• Yesterday’s News: For a disclosed Apple vulnerability in February of this year, the bug had roots as far back as the FORCEDENTRY exploit, which was used by NSO Group as part of its Pegasus spyware disclosed in 2021. 

Email Security

• New Avenues of Attack: Although Microsoft has started to block macro attachments for the Office platform, threat actors have quickly adopted other means of infections to continue targeting Windows devices – such as SEO poisoning, OneNote and Zip attachments.
• Untrustworthy Brands: Bad actors are increasingly leveraging legitimate brand names and services, like those from PayPal, Google, DWeb, and IPFS, to scam victims and steal their online credentials.

Rogue Access to the Cloud

• A Shift in Tactics: Cloud infrastructure attacks continue to rise as more and more businesses transition from on-prem infrastructure to more affordable and scalable options from Amazon, Microsoft, Google and others.
• Valid Accounts: Though more sophisticated attacks with multi-factor authentication, proxies and API execution are ascendant, the dominant attack technique continues to be through valid accounts, at more than twice the frequency of the second most used attack vector. This emphasizes that the risk of rogue access is real, as cybercriminals access and sell legitimate account logins to infiltrate and conduct attacks.

The more nefarious third-party tools such as Cobalt Strike, MimiKatz, and Sharphound are used in legitimate scenarios. Pen testers attempting to infiltrate a network may use these tools when gathering passwords, setting beacons, or elevating privileges. Threat actors use them in the same way, cutting development time and allowing an attacker to take advantage of tools recently used or accidentally left on a machine, or to reside on the system of a curious end user.

In the first quarter of 2023, the Magecart Group, APT29, and APT41 were the three most active threat groups and APTs to target users by geolocation and sectors as methods to collect monetary value, uncover government secrets, or inhibit infrastructure use. We were surprised to discover that the Magecart Group topped the list as it rarely operates at the scale of the other major nation-state-affiliated APTs. We will be monitoring the group’s activity in the months ahead to gauge whether the current period’s data signals the group’s re-emergence on the global stage.

Less sophisticated spray-and-pray techniques designed to snag anyone who might click or download plagued sectors in past global campaigns. Targeted attacks have evolved in sophistication, increasing in persistence against manufacturing, finance, and health sectors. Though the remaining two sectors, telecom and energy, appear to have been targeted less frequently in global events, both are equally important and organizations within them may not have reported a breach or remain unaware of an incident.

Reported events analyzed and vetted by our research team contain a wealth of information, correlations, or attributions of an individual threat actor, a threat group, or a more sophisticated APT. The tools, techniques, and procedures along with malware families include loader and downloader malware, RATs, information stealers, and ransomware. In the Q1 2023 events analyzed and available via Insights, we determined that Ukraine was targeted most frequently, followed closely by the U.S.

The Royal Ransom, Trigona, and Maui ransomware families were the heavy hitters in Q1 2023. Trellix recently published a detailed analysis of Royal Ransom and its inner workings with Windows and Linux executables. Although statistics represented emerged specifically from our Insights platform, many additional events occurred across the globally connected infrastructure – including known events either reported or kept private and events that have yet to be identified and remediated.

Countries Targeted in Q1 2023 Public Reports

7

In the public events available for analvsis, we determined that Ukraine was the most targeted country by threat actors, followed closely by the United States

1.

Ukraine

7%

2.

United States

7%

3.

Germany

4%

4.

South Korea

3%

5.

India

3%

Ransomware Used in Q1 2023 Public Reports

1.

Royal Ransom

7%

2.

Trigona

4%

3.

Maui

4%

4.

Magniber

3%

5.

LockBit

3%

Nation-State Activity

Insights on nation-state group activity gathered from multiple sources create a better picture of the threat landscape and help reduce observation bias. First, we depict the statistics extracted from the correlation of nation-state groups, IoCs, and Trellix customer telemetry. Secondly, we provide insights from various reports published by the security industry that are vetted, parsed, and analyzed by the Threat Intelligence Group.

As noted above, these statistics are those of the campaigns, not the detections themselves. Due to various log aggregations, our customers’ use of threat simulation frameworks, and high-level correlations with the threat intelligence knowledge base, the data is manually filtered to meet our analysis goals.

Our global telemetry showed IoCs related to several campaigns from APTs. We continue to see China-affiliated threat actors dominate the global landscape, particularly with Mustang Panda driving a significant majority of detections in Q1 2023. Since they rely heavily on sideloading and other techniques for stealth, it’s possible that China-affiliated APT groups rotate their malware tools less frequently compared to other threat actors, and – if so – this practice could lead to “projection bias” or an inflated estimate of the detections of China-affiliated hashes.

The following threat actors and their countries, their tooling and techniques as well as impacted countries and sectors represent the most prevalent in the campaigns we identified.

Vulnerability Intelligence

Trellix Advanced Research Center’s experts in reverse engineering and vulnerability analysis continuously monitor the latest vulnerabilities in order to provide guidance to customers on how threat actors are leveraging them and how to mitigate the probability and impact of these attacks.

One of our most critical – but unsurprising – findings for 2023’s first quarter is that many of this period’s most critical vulnerabilities consisted of bypasses to patches for older CVEs, supply chain bugs resulting from the utilization of outdated libraries, or long-patched vulnerabilities persisting far past their expected five minutes of fame.

Consider CVE-2022-47966, for example, a critical (9.8) vulnerability in Zoho’s ManageEngine products that made the rounds this January. ManageEngine is used by thousands of companies worldwide, so we weren’t surprised when exploitation of this vuln was detected in the wild. What astonished us was the root cause: utilization of Apache Santuario 1.4.1 – a version nearly old enough to vote – which contained a known issue allowing for XML injection. Zoho patched the vulnerability across its suite of products in October and then, almost three months later in Q1, CISA released an advisory warning of in-the-wild exploitation and urging vendors to patch.

Another example is CVE-2022-44877, a critical vulnerability in Control Web Panel (CWP). Although not directly related, this vulnerability has many of the same characteristics as our previous example: it is another 9.8 RCE that saw widespread active exploitation in January despite being patched back in October. The root cause was not exactly Black Hat-talk worthy, either: command injection using standard shell variable expansion in a URL parameter.

A third example is CVE-2021-21974, a vulnerability in VMware ESXi’s OpenSLP service that was addressed back in February 2021, almost exactly two years before its sudden resurgence due to in-the-wild exploitation. When we reported on this vulnerability in our February Bug Report, we noted around 48,000 internet-reachable servers were still running vulnerable versions of ESXi according to Shodan. Today, that number is still over 38,000 – a change of less than 22%.

Table 1: Results of Shodan scan for vulnerable ESXi instances performed in late February and late April.

We found a few examples of our own when researching Apple devices earlier this year: CVE-2023-23530 and CVE-2023-23531. These two vulnerabilities differ from the previous examples in that their impact is limited to local elevation of privilege and not RCE. This is not a reason to overlook their significance, however, as a very similar vulnerability was leveraged by the FORCEDENTRY exploit, which was used by NSO Group to deploy their Pegasus spyware back in 2021. In fact, the two CVEs we uncovered utilize the same primitive that served as the basis for the FORCEDENTRY exploit: an innocuous class called NSPredicate. Unfortunately, Apple’s approach to mitigating FORCEDENTRY involved the use of an extensive denylist to shore up the ways NSPredicate was being abused – a mitigation which failed to address the underlying problem and allowed us to bypass it.

It is tempting to point to trends such as these and conclude vendors don’t take security seriously or bemoan the regurgitation of old exploits by threat actors and researchers, but this isn’t the right takeaway. Vulnerability researchers engage in variant analysis because an effective vulnerability researcher emulates the priorities of real threat actors, and finding a mitigation bypass or an old CVE in a rarely patched product consistently produces better ROI than reinventing the wheel. For organizations which rightfully recognize this trend, the takeaway should be this: while cutting-edge threat detection technologies are irreplaceable in the modern threat landscape, many victories can be won on the fundamentals, such as patching processes and supply chain vetting.

Cloud Incidents

Cloud infrastructure attacks on services developed and delivered by Amazon, Microsoft, Google, and others continue to rise. The following data briefly describes the cloud-based attack telemetry data across our customer-based breakdown across cloud providers.

Methodology

Collection: Trellix and our seasoned, world-class experts from our Advanced Research Center gather the statistics, trends and insights that comprise this report from a wide range of global sources.

• Captive Sources: In some cases, telemetry is generated by Trellix security solutions on customer cybersecurity networks and defense frameworks deployed around the world in both public and private sector networks, including those delivering technology, infrastructure, or data services. These systems, which number in the millions, generate data from a billion sensors.
• Open Sources: In other cases, Trellix leverages a combination of patented, proprietary, and open-source tools to scrape sites, logs, and data repositories on the internet, as well as the dark web, such as “leak sites” where malicious actors publish information about or belonging to their ransomware victims.

Normalization: The aggregated data is fed into our Insights and ATLAS platforms. Leveraging machine learning, automation, and human acuity, the team cycles through an intensive, integrated, and iterative set of processes – normalizing the data, enriching results, removing personal information, and identifying correlations across attack methods, agents, sectors, regions, strategies, and outcomes.

Analysis: Next, Trellix analyzes this vast reservoir of information, with reference to (1) its extensive threat intelligence knowledge base, (2) cybersecurity industry reports from highly respected and accredited sources, and (3) the experience and insights of Trellix cybersecurity analysts, investigators, reverse engineering specialists, forensic researchers, and vulnerability experts.

Interpretation: Finally, the Trellix team extracts, reviews, and validates meaningful insights that can help cybersecurity leaders and SecOps teams (1) understand the most recent trends in the cyber threat environment, and (2) use this perspective to improve their ability to anticipate, prevent and defend their organization from cyberattacks in the future.

Resources

Threat Report Archives

The Mind of the CISO

Trellix Advanced Research Center Discovers a New Privilege Escalation Bug Class on macOS and iOS

A Royal Analysis of Royal Ransom

Feeding Gophers to Ghidra

About The Trellix Advanced Research Center

As the cybersecurity industry’s most comprehensive charter, the Trellix Advanced Research Center is at the forefront of emerging methods, trends, and actors across the global threat landscape and serves as the premier partner of security operations teams across the world. The Trellix Advanced Research Center provides intelligence and cutting-edge content to security analysts while powering our leading XDR platform. Furthermore, the Threat Intelligence Group within the Trellix Advanced Research Center offers intelligence products and services to customers globally.

Trellix Advanced Research Center

About Trellix

Trellix is a global company redefining the future of cybersecurity and soulful work. The company’s open and native extended detection and response (XDR) platform helps organizations confronted by today’s most advanced threats gain confidence in the protection and resilience of their operations. Trellix, along with an extensive partner ecosystem, accelerated technology innovation through machine learning and automation to empower over 40,000 business and government customers with living security.

Subscribe to Receive Our Threat Information

This web page and the information continued herein describes computer security research for educational purposes only and the convenience of Trellix customers. Trellix conducts research in accordance with its Vulnerability Reasonable Disclosure Policy I Trellix. Any attempt to recreate part or all of the activities described is solely at the user’s risk, and neither Trellix nor its affiliates will bear any responsibility or liability.

Trellix is a trademark or registered trademark of Musarubra US LLC or its affiliates in the US and other countries. Other names and brand may be claimed as the property of others.